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Abstract 

We develop a formalism for distilling a classical key from a quantum state in a systematic way, expanding on our previous 
work on secure key from bound entanglement [K. Horodecki et. al, Phys. Rev. Lett. 94 (2005)]. More detailed proofs, discussion 
and examples are provided of the main results. Namely, we demonstrate that all quantum cryptographic protocols can be recast 
in a way which looks like entanglement theory, with the only change being that instead of distilling EPR pairs, the parties distill 
private states. The form of these general private states are given, and we show that there are a number of useful ways of expressing 
them. Some of the private states can be approximated by certain states which are bound entangled. Thus distillable entanglement 
is not a requirement for a private key. We find that such bound entangled states are useful for a cryptographic primitive we call 
a controlled private quantum channel. We also find a general class of states which have negative partial transpose (are NPT), but 
which appear to be bound entangled. The relative entropy distance is shown to be an upper bound on the rate of key. This allows 
us to compute the exact value of distillable key for a certain class of private states. 

Index Terms 

Quantum Information Theory, Classical Key Distillation, Quantum Entanglement 

Contents 

I Introduction 

II Security contained in quantum states 3 

II-A Some facts and notations 5 

II-B On twisting and privacy squeezing |5 

III General form of states containing ideal key. 

IV Pdits and their properties J9 

10 
11 
12 



IV-A Private bits - examples 

IV-B Relative entropy of entanglement and pdits 
IV-C Irreducible pbit - a unit of privacy 



VI Expressing Alice and Bob states in terms of Eve's states 

VI-A The case without shield. "Abelian" twisting 

VI- B The general case 

VII Overview 

VII- A Pbits and twisting 

VII-B Approximating pbits with PPT states 

VII-C Nonzero rate of key from bound entangled states 

VII- D Drawing key and transforming into pbits by LOCC 

VIII Two definitions of distillable key: LOCC and LOPC paradigms 

VIII- A Distillation of pdits 

VIII-B Distillable classical secure key: LOPC paradigm 

VIII-C Comparison of paradigms 

VIII-D Composability issues 

Karol Horodecki, Department of Mathematics Physics and Computer Science, University of Gdansk, Gdansk, Poland 
Michal Horodecki, Institute of Theoretical Physics and Astrophysics, University of Gdansk, Gdansk, Poland 
Pawel Horodecki, Faculty of Applied Physics and Mathematics, Technical University of Gdansk, Gdansk, Poland 
Jonathan Oppenheim, Department of Applied Mathematics and Theoretical Physics, University of Cambridge U.K. 



Approximate pbits [12 



14 
14 
15 



16 
16 
16 
17 
17 



18 
18 
18 
20 
20 



2 



IX Equality of key rates in LOCC and LOPC paradigms 

IX-A Coherent version of LOPC key distillation protocol 

IX-B Equivalence of paradigms: The case of exact key 

IX- C Distillation of classical key and distillation of pdits - equivalence in general (asymptotically exact) case 

X Distilling key from bound entangled states 

X- A The new family of PPT states 

X-B ... can approximate pdits 

X-C Distillation of secure key 

XI Relative entropy of entanglement as upper bound on distillable key 

XII A candidate for NPT bound entanglement 

XIII Controlled private quantum channels 

XIV Conclusion 

XV Appendix 

XV-A Derivation of formula ([96]) of Sec. EH 

XV-B The proof of lemma |5] Section IX^Al 

XV-C Comparison of two criteria for secure key 

XV-D Useful inequalities relating security conditions 

XV-E Properties of pbits 

XV-F Relative entropy of entanglement and pdits 

XV-G Approximate pbits 

XV-H Relative entropy bound 

References 



I. Introduction 

We often want to communicate with friends or strangers in private. Classically, this is impossible if we wish to communicate 
over long distances, unless we have met before with our friend and exchanged a secret key which is as long as the message we 
want to send. On the other hand, quantum cryptography allows two people to communicate privately with only a very short 
key which is just used to authenticate the message. 

Every quantum cryptographic protocol is equivalent to the situation where both parties (Alice and Bob) share some quantum 
state PAB-, and then perform local operations on that state and engage in public communication (LOPC) to obtain a key which 
is private from any eavesdropper. Until recently, every quantum protocol was also equivalent to distilling pure entanglement 
from this shared state. I.e., achieving privacy was equivalent to the two parties converting many copies of the state pab, to a 
smaller number of pure EPR pairs [23] 

|^+> = -±=(|00) + |ll)), (1) 

using local operations and classical communication (LOCC), and then performing a measurement on the EPR pairs in the 
computational basis. Examples of such protocols include BB84 [7], [49], B92 [5], [51], and of course, E91 [24]. It was thus 
thought that achieving security is equivalent to distilling pure entanglement, and a number of results pointed in this direction 
[18], [19], [29], [48], [1], [28], [11]. 

Recently, however, we have shown that this is not the case - there exist examples of bound entangled states which can be 
used to obtain a secret key [34]. Bound entangled states [36] are ones which need pure entanglement to create, but no pure 
entanglement can be distilled from them. This helps explain the properties of bound entangled states. They have entanglement 
which protects correlations from the environment (or an eavesdropper), but the entanglement is so twisted that it can't be 
brought into pure form. This then raised the question of what types of quantum states provide privacy. In [34] we were able to 
find the general form of private quantum states jab A' b> ■ This allowed us to recast the theory of privacy (under local operations 
and public communication - or LOPC) in terms of entanglement theory (local operations and classical communication - or 
LOCC). In entanglement theory, the basic unit is the EPR pair, while in privacy theory, the only difference is that one replaces 
the EPR pair with general private states jaba'B' as the basic units. 

In the present article, we review the results of [34] in greater detail, and expand on the proofs and tools. Namely, we study 
and show that the general form of a private state on a Hilbert space Ha <8> H-a' ®Wb ®TLb' with dimensions Aa = ds = d, 
dA' and dg/, is of the form 
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lABA'B' = UPab ® &A'B>U\ 



(2) 



where Pj[ B is a projector onto the maximally entangled state tp + — -j^\ e ifi)^ an d U is the arbitrary twisting operation 



The key is obtained after measuring in the |ej/j) basis. We will henceforth refer to ip + as the maximally entangled or EPR 
state (or Bell state in dimension 2 x 2). We show that the rate of key Krj which can be obtained from a quantum state can 
be strictly greater than the distillable entanglement, and this even holds if the distillable entanglement is strictly zero. We also 
show [34] that the size of the private key is generally bounded from above by the regularized relative entropy of entanglement 
[54]. This will be sufficient to prove that one can have a maximal rate of key strictly less than the entanglement cost (the 
number of singlets required to prepare a state under LOCC). 

In section [TT] we introduce some of the basic concepts and terminology we will use throughout the paper. This includes the 
notion of private states, pbits which contain one bit of private key, and pdits which have many bits of key. In Section [Til] 
we show that a state is secure if and only if it is of the form given above. Then we show different useful ways to write the 
private states in Section |IV| and give some useful examples, and examine some of their properties. This includes the notion 
of irreducibility which is used to define the basic unit of privacy for private states. 

States which have a perfect bit of key must have some distillable entanglement [39]. The case of bound entangled states 
with secure key is only found in the case of states which are not perfectly secure, although they are arbitrarily secure. This 
motives our investigation in Section [V] of approximate pbits. We then demonstrate how to rewrite a bipartite state in terms 
of the eavesdropper's density matrix in Section |VI] This allows us to interpret previous results in terms of the eavesdropper's 
states. Then, in Section IVIII we summarize the previous results in preparation for showing that bound entangled states can 
have a key. In Sections I Villi and [IX] we review the paradigms of entanglement (LOCC) and privacy theory (LOPC), and show 
the equivalence of key rates in the two paradigms. We then discuss and compare security criteria in these paradigms in Section 
IXV-CI of the Appendix. In Section [X] we give a number of bound entangled states and show that they can produce a private 
key. The methods allow one to find a wide class of states which are bound entangled, because the fact that they have key 
automatically ensures that they are entangled, which is usually the difficult part in showing that a state is bound entangled (the 
PPT criteria can be quickly checked to see that the states are non-distillable). In Section [XI] we prove that the relative entropy 
distance is an upper bound on the rate of key. 

In Section IXII1 a class of NPT states are introduced which appear to be bound entangled. They are derived from a class 
of bound entangled private key states. An additional result discussed in Section IXIIII which we only mentioned in passing in 
[34], is that the bound entangled key states can be used as the basis of a cryptographic primitive we call a controlled private 
quantum channel. We conclude in Section IXIVI with a few open questions. 



In this section we will introduce the class of states which contain at least one bit (or dit) of perfectly secure key which is 
directly accessible - these we call private bits (or dits). We discuss the properties of these states and argue the generality of 
this approach. In particular we introduce the notion of twisting, which is a basic concept in dealing with private states. 

A well known state that contains one bit of secure key which is directly accessible is the singlet state. After measuring it in 
a local basis Alice and Bob obtain bits that are perfectly correlated with each other and completely uncorrelated with the rest 
of the world including an eavesdropper Eve. This is because the singlet state as a whole is decoupled from the environment, 
being a pure state. However even if a state is mixed, it can contain secure key. Yet the key must then be located only in a 
part of it. More formally, we consider a four-partite mixed state Paba'B' of two systems A, A' belonging to Alice and B, B' 
belonging to Bob. The AB subsystem of the state will be called the key part of the state - it is the part of the state which 
produces key upon measurement. The A'B' subsystem will be called the shield of the state. It is called this, because its 
presence is what will cause the AB part of the state to be secure, by shielding information from an eavesdropper. 

We assume the worst case scenario - that the state is the reduced density matrix of the pure state 4>aba'b>e where we trace 
out the system E belonging to eavesdropper Eve. We then distinguish a product basis B — {e,,/j} in system AB. For our 
purposes, without loss of generality, we often choose B to be the standard basis Distinguishing the basis is connected 

with the fact that we are dealing with classical security, which finally is realized in some fixed basis. Now, consider the state 
of systems ABE after measurement performed in the basis B by Alice and Bob. This state is of the form 



d-1 




(3) 



k,l=0 



II. Security contained in quantum states 




(4) 



ij=0 
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The above form of the state is usually called a ccq state. We will therefore refer to a ccq state associated with state Paba'B', 
and it is understood that it is also related to chosen basis B. The distribution p^ will sometimes be referred to as the distribution 
of the ccq state. 

We can now distinguish types of states paba'B' via looking at their ccq states (always assuming that some fixed basis B 
was chosen): 

Definition 1: A state paba'B' is called secure with respect to a basis B = {\eifj)AB}fj = i if the state obtained via 
measurement on AB subsystem of its purification in basis B followed by tracing out A'B' subsystem (i.e. its ccq state) is 
product with Eve's subsystem: 

d-1 

( ^2 PiMifj){Zifj\AB) ® PE- (5) 
i,j=0 

Such a state paba'B' will be also called "£> secure". Moreover if the distribution {pij} = {^ij} so that the ccq state is of 
the form 

d-1 - 

(12 -j\ e ifi)( e ifi\AB) ® PE, (6) 
»=0 

the state paba' b' is said to have B-key. 

One can ask when two states paba' b' an d ° 'aba 1 b' are equally secure with respect to a given product basis B. First let us 
define what does it mean "equally secure". A natural definition would be that when Alice and Bob measure systems AB in 
the basis, then Eve by any means cannot distinguish between two situations, as far as the outcomes of the measurement are 
concerned. In particular, the states are definitely equally secure, when their ccq states are equal. 

For our purpose we will need to know when for two states the latter relation holds. It is obvious that any unitary transformation 
applied to systems A'B' of the state paba' b 1 will not change the ccq state. (Note that it cannot be just any CP map; for 
example, partial trace of systems A'B' would mean giving it to Eve, which of course would change the ccq states). As it will 
be demonstrated in the next section, we can actually do much more without changing the ccq state. Namely we can apply an 
operation called "twisting". This operation is defined for system ABA' B' and with respect to a product basis B of AB system 
as follows: 

Definition 2: Given product basis B = {&i,fj}k,i ° n systems AB, the unitary operation acting on system ABA'B' of the 
form 

d-1 

AB®U% B ,, (7) 

fc,(=0 

is called B-twisting, or shortly twisting. 

Finally we define the class of private states. The states from that class are proven [34] to be the only quantum states which 
after measurement on Alice and Bob subsystems give an ideal key. In other words these are the only states from which Alice 
and Bob can get an ideal ccq state (|6]i according to definition Q] of security. For the sake of clarity, we recall this proof with 
details in Section Hill 

Definition 3: A state paba'B' of a Hilbert space Ha <8> Ha' ®Hb® Hb 1 with dimensions d,A = ds = d, dA> and dg', of 
the form 

d-1 

"t (d) = rfE M){eifj\AB ® UiCTA-B-U], (8) 
i,j=0 

where the state oa 1 b' is an arbitrary state of subsystem A'B', C/j's are arbitrary unitary transformations and {|ei)}^~Q , {\fj)}fZo 
are local basis on Ha and Hb respectively, is called private state or pdit. In case of d = 2 the state is called pbit. 

Note, that maximally entangled states are also private states, which is in case when d' A — d' B = 1. In general, any pdit can 
be created out of a maximally entangled state with additional state on ua 1 b> (which we will call basic pdit) by some twisting. 

Definition 4: A state paba'B' of a Hilbert space Ha <8> Ha 1 <8> Hb ® Hb 1 with dimensions dA = ds = d, dA> and dg', of 
the form 

PABA'B' = P\b ® ® A'B' i (9) 

is called a basic pdit. 

Remark 1: Let us note, that one could define states with ideal key also in a different way than in definition [1] Namely, we 
could say that the state pab has B key iff it has a subsystem ab such, that the subsystem abE of its purification \iPabe) is 
an ideal ccq state of eq. ([6j, where B = {\eifi)}f =1 . However maximally entangled state is not of this form, but is locally 
equivlent to a state of this form, i.e. they would be transformable into one another by means of unitary embeddings or partial 
isometries. In fact the whole class of so defined states with ideally secure key, would be locally equivalent to the one we have 
introduced in definition [3] and by characterization of the latter, equivalent to the class of private states. Another definition of 
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states with ideal key could be as follows. A state pab is called to have key if there are operations and Kb with Kraus 
operators {\i)k a ®X^} and {\i)K B respectively, such that the ccq state of subsystems KaKbE of the purification of 

an output state Aa<S> Kb(pab), is an ideal ccq state of eq. ©. This definition however would not allow for easy characterization 
of this class of states, and still, such states would be locally equivalent to private states defined in [3] 



A. Some facts and notations 

In what follows, by |.| we mean the trace norm, i.e. the sum of the singular values of an operator. For any bipartite operator 
X e B(Hi <§) H.2), by X r we mean the partial transposition of X with respect to system 2, that is: 

(/1 <g> T 2 )X, (10) 

where T2 denotes the matrix transposition over system 2 of a matrix X. For brevity, we will use the same symbol for 
any partial transposition. In particular, we deal often with systems of four subsystems ABA' B', and we will take partial 
transposition with respect to subsystems B and B' . Hence Paba'B' denotes (I a <8> Tb <8> I A' <£> Tb>)(paba'B'), with Tb and 
Tb> denoting the matrix transposition on systems B and B' respectively. To give example of a mixed notation, we consider 
PABA'B' G B(C 2 (E> C 2 <g> C d (g> C d ). In block matrix form, such a state has a bipartite structure of blocks, so that it reads: 



PABA'B' 



r 

Paba'B' 



A)000 


^0001 


^-0010 


^.0011 


^0100 


^0101 


^0110 


^.0111 




^4iooi 


^4ioio 


^4ion 


^.1100 


^1101 


^.1110 


Aim 


system 


BB' reads: 




^0000 


A T 


A T 

^0010 


A T 

^OllO 


A r 

^0001 


A T 


A T 

^0011 


A T 

^Olll 


^1000 


A T 


A T 

^ioio 


A T 

^1110 


^1001 


A T 


,4 r 

^lOll 


A T 



(11) 



(12) 



In the above equation, the partial transposition on LHS is with respect to system BB' and on the RHS, only with respect to 
system B', as the partial transposition with respect to system B, which is a one qubit system, resulted already in appropriate 
reordering of the block operators A^i- 

In what follows, we will repeatedly use equivalence of the trace norm distance and fidelity proved by Fuchs and van de 
Graaf [26]: 

Lemma 1: For any states p, p' there holds 



1 



fW)<i|| P - 



p'\\ < ^\-F(p,p'f 



Here F(p, p') = Tr^ ' ^fpp' \fp is fidelity; 

We also use the Fannes inequality [25] (in the form of [2]): 

\S(p)-S(a)\ <2\\p-a\\\ogd + h(\\p-a\ 

which holds for arbitrary states p and a satisfying \ \p — <j\\ < 1. 



(13) 



(14) 



B. On twisting and privacy squeezing 

Here we will show that twisting does not change the ccq state arising from measurement of the key part. Then we will 
introduce a useful tool by showing that twisting can pump entanglement responsible for security of ccq state into the key part. 
We have the following theorem. 

Theorem 1: For any state paa'BB' and any S-twisting operation U, the states paa'bb 1 and oabA'B 1 = U paa'bb'U^ have 
the same ccq states w.r.t B, i.e. after measurement in basis B, the corresponding ccq states are equal: pabe — &abe 

Proof: To show that subsystem pabe is not affected by B controlled unitary with a target on A'B' we will consider the 
whole pure state: 

Waba'B'e) = ^2 a i]klm\ijklm) = \ip) (15) 

ijklm 

(without loss of generality we take B to be standard basis). After von Neumann measurement on B and tracing out the A'B' 
part the output state is the following: 

PABE = ^ a ijklm,aijkln\ij)(ij\ ® \m}(n\. (16) 

ijklmn 
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Let us now subject \ip) to controlled unitary UabA'B' <8 Ie, 

UaBA'B' ® Ie\^) = a ijkim\ij)U ij \kl)\m) = 

ijklm 

and then on the output state \tp) perform a complete measurement on B reading the output: 

^ij I V*} I — ^ ^ ^ijkhn^-ij stn 
klmstn 

\lj){l]\AB®U^\kl){st\(W- 



(17) 



(18) 



Performing partial trace and summing over i, j we obtain the same density matrix as in dT6l > which ends the proof. ■ 

The above theorem states that two states which differ by some twisting U, have the same ccq state obtained by measuring 
their key parts, and tracing out their shields. However, since twisting does not affect only the ccq state, one can be interested in 
how the whole state changes when subjected to such an operation. We will show now an example of twisting which will be of 
great importance for further considerations in this paper. Subsequently, we will construct from this twisting an operation called 
privacy squeezing (shortly: p-squeezing), which shows the importance of the above theorem. The operation of p-squeezing is 
a kind of primitive in the paradigm which we will present in the paper. 
Consider the following technical lemma: 

Lemma 2: For any state oaba'B 1 € B(C 2 <£> C 2 <£> C d <£> C d ) expressed in the form uaba'B 1 = 2~2ijkl=o ® Mjki 

there exists twisting U ps such that if we apply this to cfabA'B', and trace out A'B' part, the resulting state on AB pab = 
TrA'B'iUpsO-ABA'B'U^} will have the form 



PAB = 



X 


X 


X 


Poonll " 


X 


X 


X 


X 


X 


X 


X 


X 


X 


X 


X 


X 



(19) 



where we omit non-important elements of pab- 

Proof: Twisting, by its definition (0 is determined by the set of unitary transformations. In the case of pbit which we now 
consider, there are four unitary transformations which determine it: {Uki}\ i_ . Let us consider singular value decomposition 
of the operator Aqoii to be VRV with V,V unitary transformations, and R - nonnegative diagonal operator. Note, that by 
unitary invariance of norm, we have that | |^4oon 1 1 = = Tri?. We then define twisting by choosing [Too = , U\\ = V, 
and Uqi — Uiq — I. The AB subsystem of twisted uabA'B 1 state is 



PAB 



l 

E 

ijkl=0 



Ti(U l3 A l]kl ul)\tj}(kl\, 



(20) 



so for such chosen twisting we have indeed, that the element |00)(11| of the matrix of Pab is equal to TrU^VRVU^ = 
Tri? = | j-Aoon 1 1» which proves the assertion. ■ 

We will give now the following corollary, which will serve as simple exemplification of this result. 

Corrolary 1: Let the key part be two qubit system. Consider then a state of the form (where blocks are operator acting on 
A'B' system): 

Araoo Ajoii 
^4oioi ^4ono 
-Aiooi ^4ioio 
Anoo Ann 



°~ ABA' B' 



(21) 



there exists twisting such that the state after partial trace on A'B' has a form 

ll^oooo 





Pab 



\\A 



noo | 





1 1-^0101 1 
1 1-^1001 1 





Pooul 
Poiioll 
Pioioll 

Pmil 



(22) 



Proof: The construction of the twisting is similar as in lemma above. This time one has to consider also the singular 
value decomposition of the operator ^4ono = WSW. m 

We can see now, that with any state paba'B', which has two qubit key part AB, we can associate a state obtained in the 
following way: 

1) For state paba'B' find twisting U ps , such, that (according to lemma |2]i it changes upper-right element of AB subsystem 
of Paba'B' into Poonll- 

2) Apply U ps to paba'B' obtaining p'aba'B' = Up S p A BA'B'U^ s . 
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3) Trace out the shield (A'B' subsystem) of state p'aba'B' obtaining two-qubit state 

Pab = ^A'B'Paba'B'- (23) 

This operation we will call privacy squeezing , or shortly p-squeezing , and the state p' AB which is the output of such 
operation on the state pab A' b 1 G B(C 2 ®C 2 <g> C d <g)C d ) the p-squeezed state of the state paba'B' ■ Sometimes we shall use 
the term privacy squeezing in more informal sense, namely, with the twisting U ps which makes the key part close to maximally 
entangled state. 

Note, that the ccq state of p-squeezed state has no more secret correlations than that of the original state. This is because it 
emerges from the operation of twisting which preserves security in some sense, i.e. it does not change the ccq state which can 
be obtained from the original state. The next operation performed in definition of p-squeezed state is tracing out A'B' part 
which means giving the A'B' subsystem to Eve. Such operation can not increase security of the state in any possible sense. 

We will be interested in applying p-squeezing in the case, where the key part of the initial state was weakly entangled, or 
completely separable. Then the p-squeezing operation will make it entangled. 

We can say, that the operation of privacy squeezing pumps the entanglement of the state which is distributed along subsystems 
AA'BB' into its key part AB. The entanglement once concentrated in the two qubit part, may be much more powerful than 
the one spread over the whole system. Further in the paper, we will see that from the bound entangled state, the operation of 
p-squeezing can produce approximately a maximally entangled state of two qubits. Then the analysis of how much key one 
can draw from the ccq state is much easier in the case of the p-squeezing state. 



III. General form of states containing ideal key. 

In this section we will provide general form of the states pab A' B' which have B key, i.e. states such that the outcomes of 
measurement in basis B are both perfectly correlated and perfectly secure. It turns out that this is precisely the class of private 
states. Hence the definitions Q] and [3] are equivalent. We have the following theorem: 

Theorem 2: Any state paba'B' of a Hilbert space Ha <8> 7~Ca' ® T^-b ® "Hb' with dimensions <1a = d B = d, d^' and d B >, 
has £>-key if and only if it is of the form 

j d-l 

PABA'B' = 3 ^ \eifi)(ejfj\AB ® UidA'B'Uj (24) 
i,3=0 

where the state <ja'B' is an arbitrary state of subsystem A'B', C/j's are arbitrary unitary transformations and {ei ® fj} = B. 
We can rewrite the state (f24t in the following, more appealing form 

PABA'B' = UPX B ® OA'B'U\ (25) 

where P AB is a projector onto the maximally entangled state ip + — "7^l e i/i)' ar, d U is arbitrary twisting operation (0. 
Since the state P\ B has many matrix elements vanishing, not all unitaries from definition of twisting are actually used here. 
In fact, unitaries [/$ in equation d24T > are to be identified with unitaries Ukk from equation (0. Note, that we can take oa i b' to 
be "classically correlated" in the sense that it is diagonal in some product basis. Indeed, twisting can change the state ua 1 b> 
into any other state having the same eigenvalues (simply, twisting can incorporate a unitary transformation acting solely on 
A'B'). 

Thus we see that the states which have key, are closely connected with the maximally entangled state, which has been 
so far a "symbol" of quantum security. As we shall see, the maximally entangled state may get twisted so much, that after 
measurement in many bases of the AB part the outcomes will be correlated with Eve, which is not the case for the maximally 
entangled state itself. Still, however the basis B will remain secure. Note that here we deal with perfect security. We will later 
discuss approximate security in Section [V] 
Proof: («=) 

This part of the proof is a consequence of the theorem Q] Namely a basic pdit (O is obviously £>-secure, because it has 
maximal correlations in this basis, and moreover it is a pure state, hence the one completely decoupled from Eve. More 
formally, it is evident that the ccq state of basic pdit is of the form ©. Now we can apply theorem [T] which says that after 
twisting the ccq state is unchanged. Hence any state of the form (|24T > has also B key. 

Proof: (=K) 

In this part we assume, that the state pab A' B> has B-key i.e. that after measurement on it's AB part, one gets a perfectly 
correlated state (between Alice and Bob) that is uncorrelated with Eve: 

d-l ^ 

(^2 j\ e ifi)( e *fi\AB) ® PE- (26) 
i=0 



x 



Let us consider general pure state for which dimensions of A, B are d, dimensions of A'.B' are dA',dB< respectively, and 
dimension of subsystem E is the smallest one which allows for the whole state being a pure one. 



ijkhn 

one can rewrite it as 



\4') = \iPabA'B'e) = Y a vki m \eifjklm). (27) 

ijkhn 

\4A=Y,\ e ^j)AB\^ ) )A>B>E- (28) 
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With ifav^A'B'E =J2klm a ijklm\klm). 

It is easy to see that the scalar product equals the probability of obtaining the state \eifj)(eifj\AB on the 

system AB after measurement in basis B. Now, since the subsystem pab e (after measurement in B on AB) must be maximally 
correlated, the vectors \tj)^) should satisfy (^W^^WJ) = 4<%. We can normalize these states (in case i = j) to have: 

|V> (ii) ) := = Vd\^) (29) 

J (^(*0|^(*0) 

so that the total state has a form: 

d-l -. 

\>l>) = Y\ ^=\e>fr)AB\4 {U) )A>B'E. (30) 

"Cryptographic al" interpretation of this state is the following: if Alice and Bob gets i— th result, then Eve gets subsystem pf 
of a state \ijj^ u ')A'B'E- Indeed, the ccq state is then of the form 



d—i , 

(31) 



i=0 



with pi = TrA'B'd^^^A'B'Ei^ 1 ^])- Now the condition d26l l implies that, pf should be all equal to each other. In particular, 
it follows that rank of Eve's total density matrix is no greater than dimension of A'B' system, hence we can assume that 
d-E = dA'ds' = df. It is convenient to rewrite this pure state in a form 



d'-l 



\lp ' ')A'B'E = \k) A 'B'Xi\k) E , (32) 



k=0 



where {\k)} is standard basis of A'B' and of E system, Xj is d E x d E matrix that fully represents this state. It is easy to 
check, that pf = XiX\. Consider now singular value decomposition of Xj given by Vi-JpiUj where pi is now diagonal in 
basis {|fc)}. One then gets that pf = VipiV} . The state (l32l may be rewritten 

\^ u) )a'b'e = Y J x I\ k )A'B'\k) E , (33) 

k 

where T is transposition in basis Now it is easy to check, that subsystem A'B' of |^>( M )) A' B' e is in state Xf(Xf)\ 

so that the whole state pab A 1 b' is the following: 

d-l 

PAB A'B' = "J J2 ^ ^ofiUB ® Xf(X]) T . (34) 



d 

i,j=0 



We can express this state using states accessible to Eve, namely p - 



E. 



^ d-l 

Pab A'B' = -: / , \eifi)(ejfj\AB 

T*-trT\ jr* /-Ti/T irt rz-TirT 



(U* V/ ) V* Jp- 1 V/ V* Vp7 j Vf (V* Ui ) . (35) 



(For expressing state in terms of Eve's states in more general case, see Section [VTIi. Denoting by Wi the unitary transformation 
U*V? one gets: 



d — 1 rp 



Pab A'B' = ~ \^)( e 3 f 3 \AB <8 Wixfpf .Jpf w}. (36) 

i,j=0 
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However, as mentioned above, Eve's density matrices are equal to each other, i.e. pf — p^ for all We then obtain 

d-l 



PABA'B' = -Z ^ \ e *fi)( e ih\AB ®W lP W] A , B ,. 



(37) 



This completes the proof of theorem |2] 



i,j=o 



IV. Pdits and their properties 

In this section we will present various forms of pdits and pbits. We will first write the pbit in matrix form according to its 
original definition. We can write it in block form 



(2) 
^ABA'B' 



Uq<TA'B'U { 




UldA'B'U, 



U a A , B ,Ul 





U^A'B'Ul 



(38) 



where a A 'B' is arbitrary state on A'B' subsystem, and Uq and U\ are arbitrary unitary transformations which act on A'B'. 

"Generalized EPR form " of pdit. Since by the theorem of the previous section pdits are the only states that contain S-key, 
they could be called generalized EPR states (maximally entangled state). We have already seen that they are "twisted EPR 
states". One can notice an even closer connection. Namely, a pdit can be viewed as an EPR states with operator amplitudes. 
Indeed, one can rewrite equation ( f34l > in a more appealing form 



with 



"fABA'B' 



d-l 



AB- 



(39) 



(40) 



i=0 



We have written here (unlike in the rest the of paper) first the A'B' system and then the AB one, so that this form of pdit 
would recall a form of pure state. Thus instead of c-numbers the amplitudes are now q-numbers, so that states which have key 
are "second quantized EPR states". In the case of pbits, the matrix form is the following: 



(2) 

Iaba'B' 



y yJ 


































YiYj 








YxYl 



(41) 



Let us consider the polar decomposition of operators Y^. From definition of pdit it follows that the only constraint on these 
operators is the following 

V, Y = Uijp, (42) 



where ?7, is unitary transformation and p is a normalized state as so is the ga 1 b 1 state in form 

This reflects the fact, that similarly like maximally entangled state which produces correlated outputs has amplitudes with 

probably different phases, but the same moduli, the "maximally private" state can have "operator amplitudes" which differ by 

Ui ( a counterpart of the phase) but have the same yfp in polar decomposition (which is a counterpart of the modulus). 
There is yet another similarity to EPR states, namely the norm of upper-right block YqY^ is equal to |, like the modulus 

of the coherence of the EPR state. 

"X-form" of pbit. In special case of pbits one can have representation by just one normalized operator: 



(2) 
"fABA'B' 



VxJo oo x 





Xt \ZxTx 



(43) 



for any operator X satisfying ||X|| = 1. 

Justification of equivalence of this form and standard form is the following. Consider singular value decomposition of X 
X = UaW with U and W unitary transformations and a being diagonal, positive matrix. Since X has trace norm 1, the same 
is for a, therefore it can be viewed as X = UpW with p being a legitimate state. Identifying Uo = U and U\ — W' we 
obtain standard form. 
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It is important, that in nontrivial cases X should be a non-positive operator. Otherwise the pbit is equal to basic pbit. Indeed, 
if it is positive, then since its trace norm is 1, it is itself a legitimate state, call it p. Then VXXf = V X^X = p, so that 



1 



l 



PABA'B' = ~ 2^ 



ii)(jj\®p= \4>+){fa 



which is the basic pbit (|9]). 

Note, that in higher dimension to have the X-form we need more than one operator, and the operators depend on each other, 
which is not as simple representation as in the case of pbit. For example in d = 3 case we have: 














X 











XY 



















































































xt 











Vx^x 











Y 






























































































yt 














(44) 



where the operators X and Y satisfy: \\X\ \ = 1 and X = WY^ for arbitrary unitary transformation W. 

"Flags form": special case of X -form. If the operator X which represents pbit in its X-form is additionally hermitian, any 
such pbit can be seen as a mixture of basic pbit and a variation of basic pbit which has EPR states with different phase: 

IaIa'b- = PIV'+W+I® Pa-b- + (!- ■PJIV'-W-I® Pa'b'. ( 45 > 
■4s (| 00) ± 1 1 1) ) . Derivation of this form is straightforward, if we consider decomposition of X into positive 
' ")]: 

X=X+-X_, (46) 

TrX + , together with assumption of X-form 

(47) 



where \ip±) 
and negative part [9]: 



where X + and X- are by definition orthogonal, and positive. Thus denoting p 
that \\X\ \ = Tr\X\ = 1, we can rewrite X as 

X =pp+ - (1 -p)p-, 

where p± are normalized positive and negative parts of X. Moreover, since the states p + and p_ are orthogonal: Trp_p + = 0, 
we obtain the form ( |43T >. 



A. Private bits - examples 

We will give now two examples of private bits, and study its entanglement distillation properties. 
Examples of pbit 

1) Let us consider state ^ v G B(C 2 ®C 2 ®C d <g> C d ) of the following form: 

Xr 



v 1 
7 =2 







v 












TP 



(48) 



where V is the swap operator which reads: V = Ki)0'*l- ^ we consider positive and negative part of V, which 

are symmetric and antisymmetric subspace, it is easy to see, that 



7 y = P \l/) + ) (lP + | ® Ps + (1 - p)\ | ® Pa 



where 



d 2 



p 

, 1 sym 

d 



Pa 



d? - d PaSVm 



(49) 



(50) 



are symmetric and antisymmetric Werner states, and p — i(l + 4). Thus we have obtained, that it is also a pbit with 
natural "flags form", with flags being (orthogonal) Werner states [58]. 
2) The second example is the state known as "flower state", which was shown [31] to lock entanglement cost. We have 
that pf i OW er 6 B(C 2 ®C 2 ® C d2 ® C d2 ) is of the form: 





_ 1 

! flower 2 



a U U \U T 





a 



(51) 



11 



where a is classical maximally correlated state: a — J2i=o ll^i^l' anc ^ ^ ' s trie embedding of unitary transformation 
W = Y^,i 7=0 m y K)0l = H® logd with _ff being Hadamard transform in the following way: 

d-l 

hj=0 

We can check now, that this state is pbit with X-form. In this case X — U T . To see this consider unitary transformation 
S := U* + Composing 5* with U T does not change the norm, which is unitarily invariant, so that 

\\lu T \\ = \\±U T S\\ = \\±J2\n)(n\\\ = l- (52) 

j=0 

Thus we see, that \ \X\ \ = 1. We have also V XX^ = a: 

^UTU* = [±Y,\ii){ii\]?=a. (53) 

i=0 

We will show now, that in case of j v given in eq. (f48b , the distillable entanglement Ed is strictly smaller then the amount 
of secure key Kd gained from these states. The formal definition of Kd is given in Section I Villi Here it is enough to base 
only on its intuitive properties. Namely, any pdit by its very definition has Kjj at least equal to logd of key, which can be 
obtained by measuring its key part. To show the gap between distillable entanglement and distillable key we will compute the 
value of another measure of entanglement: log-negativity Em{p) (see [59]) of the state, which is an upper bound on distillable 
entanglement [56]. To this end consider th e follo wing l emma. 

Lemma 3: For any pbit in JT-form, if \/xJO and VxJx are PPT, the log negativity of the pbit in X-form reads En = 
log(l + ||X r ||), where V is transposition performed on the system B' . 

The proof of this lemma is given in Sec. IXV-EI of Appendix. Using this lemma, one can check the negativity of the state 
r y v . We have in this case X — with d>2. Since V F = dP + , we obtain En('J V ) — log(l + ^). It implies: 

E D (j v ) < £ W (7 V ) = log(l + ~) < 1 < Kni^), (54) 

a 

which demonstrates a desired gap between distillable key and distillable entanglement: 

E D ( 7 V ) < Kui^). (55) 



B. Relative entropy of entanglement and pdits 

In this section we will consider the entanglement contents of the pbit in terms of a measure of entanglement called relative 
entropy of entanglement, defined as follows: 

E r (p) = inf S(p\a sep ) (56) 

where 5(/9||cr) = —S(p) — Trploger is the relative entropy, and SEP is the set of separable states. In the Section IXJ we will 
show, that for any state, the relative entropy of entanglement is an upper bound on the key rate, that can be obtained from the 
state (for generalizations of this result to a wide class of entanglement monotones see [13], [14]). It is then easy to see, that 
for any pbit 7, E r (-f) is greater than log<i since Ko(^f) > \ogd by definition of pdits. The question we address here, is the 
upper bound on the relative entropy of the pdit. We relate its value to the states which appear on the shield of the pdits, when 
Alice and Bob get key by measuring the key part of the pdit. The theorem below states it formally. 

Theorem 3: For any pdit ^abA'B' € B{C d <£> C d <£> C djl ® C dfi ), which is secure in standard basis, let p^, B , denote states 
which appears on shield of the pbit, after obtaining outcome ii in measurement performed in standard basis on its key part. 
Then we have 

d-l 

MlABA'B') < log^+ -lH E ^PA'B') (57) 

where AB denotes key and A'B' shieldpart of the pdit. 

Proof: One can view the quantity ^ J2i=o ^r(PA'B') as me relative entropy of jabA'B' dephased on AB in computational 
basis [31]. In case d = 2 k , it can be easily done with applying unitary Ui - random sequence of a z and / unitary transformations. 
In general case one can use the so called Weyl unitary operators (see e.g. [27]). Such an implementation of dephasing uses 
logd bits of randomness. 
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Following the proof of non-lockability of relative entropy of entanglement [31] (see also [42]), we can write 

ErijABA'B') - Eri^pia,) < log d (58) 

i 

where ct; = [7, ® Ia'B'Iaba'B'U} ® Ia'B' and pi = 4. As we have observed above, the relative entropy of dephased state 

Y^iViVi equals \ J2i=o E r(pA'B') which ends the proof. 

The above theorem is valid also for regularized relative entropy, defined as [21] 

E r { P r = lim -E r (p® n ), (59) 

n^oo Tl 

Theorem 4: Under the assumptions of theorem [3] there holds: 

d-l 

E?{ 1A ba>b>) < \ogd + - ]T E?(Pa>b>), (60) 

i=0 

For the proof of this theorem, as rather technical, we refer the reader to Appendix IXV-FI 

C. Irreducible pbit - a unit of privacy 

In Section [Til] we have characterized states which contain ideal key i.e. pdits. A pdit has an AB subsystem called here the 
key part, log d bits of key can be obtained from such a pdit by a complete measurement in some basis performed on this key 
part of pdit . However, as it follows from the characterization given in theorem [2] pdits have also the A'B' subsystem, called 
here the shield. This part can also serve as a source of key. Indeed there are plenty of such pdits that contain more than log d 
key, due to their shield. Therefore not every pdit can serve as a of unit of privacy and we need the following definition: 

Definition 5: Any pdit 7 (with d-dimensional key part) for which Kd{~i) — logd is called irreducible. 

This definition distinguishes those pdits for which measuring their key part is the optimal protocol for drawing key. They 
are called irreducible in opposite to those, which can be reduced by distillation protocol to some other pdits which have more 
than logd of key. Irreducible pdits are by definition units of privacy (although they are not generally interconvertible). 

Determining the class of irreducible pdits is potentially a difficult task, as it leads to optimisation over protocols of key 
distillation. However we are able to show a subclass of pdits, which are irreducible. To this end we use a result, which is 
proven in Section |XI] namely that the relative entropy of entanglement is an upper bound on distillable key. Having this we 
can state the following proposition: 

Proposition 1: Any pdit 7, with E r (j) = \ogd, is irreducible. 

Proof: By definition of pdit we have Krj(j) > \ogd and by theorem [9] from Section IXTI we have Ko{^) < E r (j) which 
is in turn less than logd by assumption, and the assertion follows. We can provide now a class of pdits which have E r = logd 
and by the above proposition are irreducible. These are pdits which have separable states that appear on shield conditionally 
on outcomes of complete measurement on key part part in the computational basis. 

Proposition 2: For any pdit ^aba'B 1 € B(C d ® C d ® C dA ® C ds ), which is secure in standard basis, if p^, B i denote states 
which appear on shield of the pbit, after obtaining outcome in measurement performed in standard basis on its key part 
are separable states, then pdit ^abA'B 1 is irreducible. 

Proof: Due to bound on relative entropy of pdit given in theorem [3] we have that E r (j) is less then or equal to logd 
since conditional states p^B' ^ separable and hence have relative entropy of entanglement equal to zero. E r (-j) is also not 
less then log d, since it is greater than the amount of distillable key, which ends the proof. 

Note, that examples (|48l >, ([5TT > given in Section IIV-AI fulfill the assumptions of this theorem, and are therefore irreducible 
pbits. They are also the first known non trivial states (different than pure state) for which the amount of distillable key has been 
calculated. Using the bound of relative entropy on distillable key, one can also show, that the class of maximally correlated 
states has Kd = Ed = E r , since for the latter Ed = E r . 

V. Approximate pbits 

We present here a special property of states which are close to pbit. We have already seen, that pbits have similar properties 
to the maximally entangled EPR states. In particular, the norm of the upper-right block in standard form as well as in X-form 
of pbit is equal to i. We will show here, that for general states the norm of that block tells how close the state is to a pbit: 
any state which is close in trace norm to pbit must have the norm of this block close to i, and vice versa. 

We will need the following lemma that relates the value of coherence to the distance from the maximally entangled state 
for two qubit states. 

Lemma 4: For any bipartite state pab € B(C 2 ®C 2 ) expressed on the form pab — 2~2ijkl=o a ijki\ij){kl\ we have: 

Trp AB P + >l-e^ i?e(a 00 ii) > ^ -e (61) 
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and ^ 

Re(a oou ) > - - e Trp AB P+ > 1 - 2e (62) 

Proof: For the proof of this lemma, see Appendix IX V-GI 
We can prove now that approximate pbits have norm of an appropriate block close to i. 

Proposition 3: If the state cfabA'B' € B(C 2 <B> C 2 <8> C d (£> C d ) written in the form ctaba'B' = X)ijjw=o ® -^jj/W 

fulfills 

| \o~ABA'B' - "/ABA' B 1 1 1 < £ (63) 

for some pbit 7, then for < e < 1 there holds ||A 00 ii|| > \ — e. 

Proof: The pbit 7 is a twisted EPR state, which means that there exists twisting U which applied to basic pbit P + ® p gives 
7. We apply this U to both states a aba 1 b< and 7 and trace out the A'B' subsystem of both of them. Since these operations 
can not increase the norm distance between these states, so that we have for oab — ^A'B' U o~aba'B' U' 

\\<tab-P+\\ <e. (64) 
It implies, by equivalence of norm and fidelity (fl} that 

F(a AB ,P+)>l-±e. (65) 

We have also that F(<jab, P+) 2 = T^^abP+ so that 

Tr<J AB P+ > 1 - e (66) 

for e < 1. Now by lemma © this yields |ooon| > Re(aoou) > | — e, where aoon is coherence of the state pab = 
J2ijki=o a tjki\ij){kl\. However, we have 

laooixl - \^U m A mil u{ x \ (67) 

where C/oo an d U\\ come from twisting, that we have applied. Using now the fact that ||A|| = sup^ TiAU, where supremum 
is taken over unitary transformations we get 

||4)oii|| > |aooii| > 1-e. (68) 

This ends the proof. ■ 

Now we will formulate and prove the converse statement, saying that when the norm of the right upper block is close to 
1/2, then the state is close to some pbit. 

Proposition 4: If the state gabA'B' € B(C 2 <g> C 2 ® C d <£> C d ') with a form o~ A bA'B' = Z)yw=o ® A? fei fulfills 

I l-^ooii 1 1 > I — e men f° r < e < | there exists pbit 7 such, that 

\\0ABA'B' - lABA'B'W < 8(e) (69) 

with 5(e) vanishing, when e approaches zero. More specifically, 



5(e) = 2y8V2e + h(2V2e) + 2V2e (70) 

with h(.) being the binary entropy function h(x) = — xloga; — (1 — x) log(l — x). 

Proof: In this proof by px we denote respective reduced density matrix of the state pab A 1 b> ■ Let pab be the privacy- 
squeezed state of the state uaba'B' i.e. pab = Tr A 'B>PABA>B> where paba>b> = U ps a A BA'B'Ul s for certain twisting U ps . 
By definition the entry doou of pab is equal to ||A)oii||- By assumption we have, a on = ll^ooull > 5 — £■ By lemma |4] 
(equation j62l ) we have that 

Trp AB P+ > 1 - 2e. (71) 

We have then 

F(pa Bi P+) 2 = Trp AB P+ (72) 

which, by equivalence of norm and fidelity (\3[ gives 

Wpab - P+\\ < 2V2~e. (73) 

Let us now consider the state pabA'B' — U ps crABA'B'U^ s and its purification to Eve's subsystem ipABA'B'E so that we 
have: 

PAB = T^A'B'E^ABA'B'e) (74) 
By the Fannes inequality (see eq. ( fT4b in Sec. Ill-Al l we have that 

S(pab) = S(pa'B'e) < 4V2~e\ogd A B + h(2V2e). (75) 
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^From this we will get that \\ipABA'B>E — Pab <8> Pa>b>e\ \ is of order of e. We prove this as follows. Since norm distance is 
bounded by relative entropy as follows [45] 

l\\pi~P2\\ 2 <S( P1 \ P2 ), (76) 

one gets: 



| \i>ABA'B'E - PAB ® PA'B'E \ \ < \flS{$ABA'B'E\\pAB ® PA'B'e)- (77) 

The relative entropy distance of the state to it's subsystems is equal to quantum mutual information 

I{^ab\a'b'e) = S(pab) + S(pa'B'e) ~ S(^ AB a'B'e), (78) 
(We will henceforth use shorthand notation I(X : Y), S(X)). which gives 

I(AB : A'B'E) = 2S(AB) < 2(AV2e\ogd A B + h{2^2e)). (79) 
where last inequality comes from Eq. (1751 1, Coming back to inequality ( fTTT i we have that 



\\i>ABA>B'E - PAB ® Pa>B'e\\ < ^2I(AB : A'B'E) < 2^4V2~elogd AB + h{2-fll) (80) 
If we trace out the subsystem E the inequality is preserved: 

Wpaba'B' - Pab <8> PA'B'W < 2-\/8Vi + /i(2Vi), (81) 
where we have put (Lab = 4, as we deal with pbits. Now by triangle inequality one has: 

WPABA'B' -P+ ® PA'B'W < WPABA'B' - PAB ® PA'B'W + \ \PAB ® PA' B' ~ P+ ® PA'B'W- ( 82 ) 

We can apply now the bounds d73l ) and ( T8Tb to the above inequality obtaining 



IIpaba'B' -P+® PA'S' II < 2^8^26 + / l (2V2e) + 2V2e. (83) 

Let us now apply the twisting U^ s (transformation which is inverse to twisting U ps ) to both states on left-hand-side of the 
above inequality. Since Paba'B' is defined as U ps a aba 1 B'Uj> s we get that: 



VABA'B' -Ul s P + ® pA'B'U ps \\ < 2^8V2~e + h(2V2~e) + 2V2l, (84) 



i.e. our state is close to pbit 7 = Uj ls P+ <S> pA'B'U ps . Then the theorem follows with 5(e) = 2y 8\/2e + h(2\j2~t) + 2\/2e. ■ 
Remark 2: The above propositions establish the norm of upper-right block of matrix (written in computational basis according 
to ABA'B' order of subsystems), as a parameter that measures closeness to pbit, and in this sense it measures security of the 
bit obtained from the key part. The state of form (|2~TT > is close to a pbit if and only if the norm of this block is close to i. 
This is the property of approximate pbits, however it seems not to have an analogue for approximate pdits with d > 3. 

VI. Expressing Alice and Bob states in terms of Eve's states 

In this section we will express the state pabA'B' in such a way that one explicitly sees Eve's states in it. We will then 
interpret the results of the previous sections in terms of such a representation. In particular, we will see that the norm of the 
upper-right block not only measures closeness to pbit, but it also measures the security of the bit from the key part directly, 
in terms of fidelity between corresponding Eve's states. 

A. The case without shield. "Abelian " twisting. 

Consider first the easier case of a state without shield i.e. 

PAB = ^2 Pi3i'j'\ i 3)( i 'j , \- ( 85 ) 
iji'j' 

Purification of this state is of the following form 

tpABE = ^2 VPij\ij) 'abWD (86) 

where pij = Pijij. We see, that when Alice and Bob measure the state in basis \ij), Eve's states corresponding to outcomes 
ij are ipij, and they occur with probabilities pij. Performing partial trace over Eve's system, one obtains 

Pab = y/PijPi'o' We IV^IuXi'/l (87) 

iji'j' 
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Thus the matrix elements of pab are inner products of Eve's states. If we have all inner products between set of states, we 
have complete knowledge about the set, up to a total unitary rotation, which is irrelevant for security issues (since Eve can 
perform this herself). Thus density matrix pab can be represented in such a way that all properties of Eve's states are explicitly 
displayed. Moreover, moduli of matrix elements are related to fidelity between Eve's states: 

\Piji'j> \ = y/PijPi'j' F(tp%,^y ). (88) 
a) Two-qubit case.: For example, for two qubits, the density matrix looks as follows (we have not shown all elements) 



PAB 



Poo 


X 


X 


X 


Poi 


X 


X 


X 


PlO 


X 


X 


X 



(89) 



x 

X 

Pu 

Let us now consider the conditions for having one bit of perfect key obtained from the measurement in the two qubit case. 
They are as follows: (i) poo = Pn = 1/2 an d (ii) V'oo = ipn U P to a phase factor. The latter condition is equivalent to 
F(ipoo, ipu) — 1 (we have dropped here the index E). The two conditions can be represented by a single condition: 

VPooPii^OocV'ii) = \ (90) 

However, we know from ( |88l that this means that upper-right matrix element of pab should satisfy | poon I = 1/2- Consider 
now approximate bit of key, so that the conditions are satisfied up to some accuracy. Again we can combine them into single 
condition 

VP^ITF^, O > - - e (91) 
|poou|>^-e, (92) 
F 2 < i(l + 2|poon|), (93) 



This translates into 



which gives: 



where ^ ME = ^(e^°°|00) + e^|ll», and F 2 = (^meWme). 

Thus, in particular for F = 1, we must have |poon| = 1/2- The change of phases can be viewed as a unitary operation, 
where phases are controlled by the basis \ij): 

U = J^\ij)(ij\e i ^ (94) 

ij 

Since we have i/) max = U\ijj+}, this operation can be called "abelian" twisting. Abelian because only phases are controlled. 
Thus we can summarize our considerations by the following statement. A two-qubit state has perfectly secure one bit of key 
with respect to basis if and only if it is a twisted EPR state (by abelian twisting of Eq. (194[ ): 

PAB =U\^ + )(iP+\Ul (95) 

Moreover, if a state satisfies security condition approximately, it must be close in fidelity to some state Uif)+. The quality of 
the bit of key is given by magnitude of a c-number | Poon I - 



B. The general case. 

In this section we will represent in terms of Eve's states the state which has both key part and shield. We will see then, 
how the twisting becomes "nonabelian", and the condition of closeness to pure state Utj)+ changes into that of closeness to 
pbit. If we write state in basis of system AB (key part) we get blocks A^iy instead of matrix elements 

Paba'b 1 = lyW*'i'l ® A f'i'- ( % ) 

iji'j' 

After suitable transformations (see Appendix IXV-AI for details), we arrive at the following form: 

PABA'B' = VPijPi'j'^ABii'f] O {U l3 \[7l\ff^' U\ lj ,) T , (97) 
iji'j' 

where the operator = UijWVij maps the space Ha'B' exactly onto a support of p 1 ^ in space He, and the dual operator 
Uij = VijW^l/jj maps the support of p 1 ^ back to Ha'B'- 

Let us note, that in parallel to Eq. (l88l we have that the trace norms of the blocks A are connected with fidelities between 
Eve's states 

ll-WII = Vm*f F (p%>pE') ( 98 ) 
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b) The case of two qubit key part: If the key part is two qubit system we get 

PoopmP°E U lo\ T x x ^PmPu [Woo 

x pMxp^Ul^ x 

x x p w [U w p^U\ ] T 

XXX 



PABA'B' 



(99) 



Let us now discuss conditions for presence of one bit of key. They are again (i) poo 



Poo [KnP^F 
Pn = h an d (ii) Eve's states are the 



same p™ = p^. This is equivalent to 



VmpTiF{p E 1 ,p 1 E 1 ) = \ 



(100) 



which is nothing but trace norm of upper-right block ||A oii||- Also conditions for approximate bit of key requires the norm to 
be close to ^ Moreover, to see how pbit and the twisting arise, let us put all Eve's states equal to each other, and probabilities 



corresponding to perfect correlations. We then obtain 



PABA'B' 



AB 



(101) 



where pe is one fixed state, that Eve has irrespectively of outcomes. We see here almost the form of pbit. One difference 
might be is that instead of usual unitaries, we have some embeddings Uu. However, since now Eve's space is of the same 
dimension as A'B' (because Eve has single state), they are actually usual unitaries. The transposition does not really make a 
difference, as it can be absorbed both by state, and by unitaries. It is interesting to see here in place of phases from previous 
section the unitaries appeared, so that abelian twisting changed into nonabelian one. Also the condition for key changed from 
modulus of c-number - matrix element, to a trace norm of q-number - a block. 



VII. Overview 

In this section we will shortly summarize what we have done so far. Then we will describe the goals of the paper, and 
briefly outline how we will achieve them. 



A. Pbits and twisting 

We have considered a state shared by Alice and Bob, which was divided into two parts: the key part AB and the shield 
A' B' . The key part is measured in a local basis, while the shield is kept. The latter is seen by Eve as an environment that 
may restrict her knowledge about outcomes of measurement performed on the pdit. 

We have shown two important facts. First, we have characterized all the states for which measurement on the key part 
gives perfect key. The states are called pdits, and they have a very simple form. Moreover, we have shown that twisting does 
not change the ccq state arising from measurement on the key part part. (We should emphasize here, that twisting must be 
controlled by just the same basis in which the measurement is performed.) 

This is an interesting feature, because twisting may be a nonlocal transformation. Thus even though we apply a nonlocal 
transformation to the state, the quality of the key established by measuring the key part (in the same basis) does not change. 
^From the exhibited examples of pbits, we have seen that some of them have very small distillable entanglement. Since pbits 
are EPR states subjected to twisting, we see that in this case the twisting must have been very nonlocal, since it significantly 
diminished distillable entanglement. Because pbits contain at least one bit of secure key, we have already seen that distillable 
key can be much larger than distillable entanglement. 

However our main goal is to show that there are bound entangled states from which one can draw key. Thus we need 
distillable entanglement to be strictly zero. Here it is easily seen that any perfect pdit is an NPT state. Even more, one can 
show that pdits are always distillable [39]. Thus we cannot realize our goals by analysing perfect pbits. 

B. Approximating pbits with PPT states 

After realising that pbits cannot be bound entangled, one finds that this still does not exclude bound entangled states with 
private key. Namely, even though bound entangled states cannot contain exact key (as they would be pbits then) they may 
contain almost exact key. Such states would be in some sense close to pbits. Note that this would be impossible, if the only 
states containing perfect key were maximally entangled state. Indeed, for d £g> d system if only a state has greater overlap than 
1/d with a maximally entangled state we can distill singlets from it [6]. 

Recall, that for a state with key part being two qubits, the measure of quality of the bit of key coming from measuring 
the key part is trace norm of upper-right block. The key is perfect if the norm is 1/2 (we have then pbit) and it is close to 
perfect, if the norm is close to 1/2. Thus our first goal will be to find bound entangled states having the trace norm of that 
block arbitrarily close to 1/2. We will actually construct such PPT states (hence bound entangled) in Sections IX-AI IX-Bl In 
this way we will show that there exist bound entangled states that contain an arbitrarily (though not perfectly) secure bit of 
key. 
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C. Nonzero rate of key from bound entangled states 

It is not enough to construct bound entangled states with arbitrary secure single bit of key. The next important step is to 
show that given many copies of BE states one can draw nonzero asymptotic rate of secure key. To show this we will employ 
(in Section IX-Q the BE states with almost perfect bit of key. Let us outline here the most direct way of proving the claim. 

To be more specific, we will consider many copies of states p t which have upper-right block trace norm equal to 1/2 — e. We 
will argue that one can get key by measuring the key part of each of them, and then process via local classical manipulations 
and public discussion the outcomes. How to see that one can get nonzero rate in this way? 

We will first argue, that the situation is the same, as if the outcomes were obtained from a state which is close to maximally 
entangled. To this end we will apply the idea of privacy squeezing described in Section III-BI 

First recall, that we have shown that operation of twisting does not change security of ccq state - more precisely, it does not 
change the state of the Eve's system and key part of Alice and Bob systems, which would arise, if Alice and Bob measured 
the key part. Thus whatever twisting we will apply, from cryptographic point of view the situation will not change. The total 
state will change, yet this can be noticed only by those who have access to the shield of Alice and Bob systems, and Eve does 
not have such access. 

We will choose such a twisting, that will change the upper-right block of p e into a positive operator. This is exactly the 
one which realizes privacy squeezing of this state. Now, even though security is not changed, the state is changed in a very 
favorable way for our purposes. Namely, we can now trace out the shield, and the remaining state of the key part (a p-squeezed 
state of the initial one) will be close to maximally entangled. Indeed, twisting does not change trace norm of the upper-right 
block. Because now the block is a positive operator, its trace norm is equal to its trace, and tracing out shield amounts just 
to evaluating trace of blocks. Since the trace norm was 1/2 — e, the upper-right element of the state of key part is is equal 
to 1/2 — e, which means that state is close to maximally entangled (where the corresponding element is equal to 1/2). One 
can worry, that it is now not guaranteed that the security is the same, because we have performed not only twisting, but also 
partial trace over shield. However the latter operation could only make situation worse, since partial trace means giving the 
traced system to Eve. 

Now the only remaining thing is to show that we can draw key from data obtained by measuring many copies of state close 
to an EPR state, then definitely we can draw key from many copies of more secure ccq state obtained from our p e . To achieve 
the goal, we thus need some results about drawing key from ccq state. Let us recall that we work in scenario, where Alice and 
Bob are promised to share i.i.d. state, so that the ccq state is tensor product of identical copies. In this case, the needed results 
have been provided in [19]. It follows, that the rate of key is at least I(A : B) — I(A : E), where / is mutual information. 
If instead of almost-EPR state, we have just an EPR state, the above quantity is equal to 1. Indeed, perfect correlations, and 
perfect randomness of outcomes gives I(A : B) = 1 and purity of the EPR state gives I(A : E) = 0. Since we have state 
close to an EPR state, due to continuity of entropies, we will get I(A : B) » 1, and I(A : E) w 0. Thus given n copies of 
states that approximate pbits one can get almost n bits of key in limit of large n. 

D. Drawing key and transforming into pbits by LOCC 

Apart from showing that key can be drawn from BE states, we want to develop the theory of key distillation from quantum 
states. To this end in Section IVIIII we recast definition of distilling key in terms of distilling pbits by local operations and 
classical communication. This is important change of viewpoint: drawing key requires referring to Eve; while distilling pbits 
by LOCC concerns solely bipartite states shared by Alice and Bob, and never requires explicit referring to Eve's system. Thus 
we are able to pass from the game involving three parties: Alice, Bob and Eve to the two players game, involving only Alice 
and Bob. 

We will employ two basic tools: (i) the concept of making a protocol coherent; (ii) the fact (which we will prove) that 
having almost perfectly secure ccq state is equivalent to having a state close to some pdit. Note that in one direction, the 
reasoning is very simple: if we can get nonzero rate of asymptotically perfect pdits by LOCC, we can also measure them at 
the end, and get in this way asymptotically perfect ccq states, which is ensured by item (ii) above. The converse direction is 
a little bit more involved: we take any protocol that produces key, apply it coherently, and this gives pure final state of Alice, 
Bob and Eve's systems. From (ii) it follows, that the total state of Alice and Bob must be close to pdit. 

Let us briefly discuss how we will show the fact (ii). The essential observation is that both the ccq state pabe an d Alice 
and Bob total state paba'B' are reductions of the same pure state i/jaba'B'E- Here some explanation is needed: in general, 
since the ccq state is obtained by measurement, it is not reduction of ipABA'B'E- However, one can first apply measurement 
coherently to the state paba'B'- Then the ccq of the new state p'aba'B' * s indeed the reduction of ^'abA'b'e- ^ n tne acma l 
proof we will proceed in a slightly different way. 

Now, if we have two nearby ccq states, we can find their purifications that are close to each other too. Then also Alice and 
Bob states arising when we trace out Eve's system are close to each other (because partial trace can only make states closer). 
The whole argument is slightly more complicated, but the above reasoning is the main tool. 

The equivalence we obtain puts the task of drawing key into the standard picture of state manipulations by means of LOCC. 
The theory of such manipulations is well developed and, in particular, there are quite general methods of obtaining bounds on 
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transition rates (in our case the transition rate is just distillable key), see [35]. Indeed, we will be able to show that relative 
entropy of entanglement is an upper bound for distillable key. The main idea of deriving the bound is similar to the methods 
from LOCC state manipulations. However significant obstacles arise, to overcome which we have developed essentially new 
tools. 

VIII. TWO DEFINITIONS OF DISTILLABLE KEY: LOCC AND LOPC PARADIGMS 

In this section we show that distillable amount of pdits by use of LOCC denoted by Kb is equal to classical secure key 
distillable by means of local operations and public communication (LOPC). 

A. Distillation of pdits 

We have established a family of states - pdits - which have the following property: after measurement in some basis B 
they give a perfect dit of key. In entanglement theory one of the important aims is to distill singlets (maximally entangled 
states) which leads to operational measure of distillable entanglement. We will pose now an analogous task namely distilling 
pdits (private states) which are of the form ([8]). This gives rise to a definition of distillable key i.e. maximal achievable rate of 
distillation of pdits. Similarly as in the case of distillation of singlet, it is usually not possible to distill exact pdits. Therefore 
the formal definition of distillable key Kb will be a bit more involved. 

Definition 6: For any given state pab & B{TLa®'Hb) let us consider sequence P n of LOCC operations such that = 
er„, where a n € B(Ti.^ ®7i^). A set of operations V = U^ =1 {P n } is called pdit distillation protocol of state pab if there 
holds 

lim 11^-7^11 = 0, (102) 

n — >oo 

where is a pdit whose key part is of dimension d n x d n . 
For given protocol V, its rate is given by 

TZ(V) -lim sup (103) 

n — >oo Tl 

The distillable key of state pab is given by 

Kd(pab) =snpU(V). (104) 

V 

In other words, due to this definition, Alice and Bob given n copies of state pab try to get a state which is close to some 
pdit state with d = d n . Unlike so far in entanglement theory, effect of distillation of quantum key depends not only on the 
number n of copies of initial state but also on the choice of the output state. This is because private dits appears not to be 
reversibly transformable with each other by means of LOCC operations, as it is in case of maximally entangled states in 
LOCC entanglement distillation. Thus the quantity Kb, is a rate of distillation to the large class of states. (Of course, since 
the definition involves optimization, Kb is well defined; in particular the expensive pdits will be suppressed). 

One can be interested now if this new parameter of states Kd{p) has an operational meaning for quantum cryptography. 
One connection is obvious: given a quantum state Alice and Bob may try to distill some pdit state, and hence get (according 
to the above definition) Kb(pab) bits of key if such distillation has nonzero rate. However the question arises: is it the best 
way of extraction of a classical secure key from a quantum state? I.e. given a quantum state is the largest amount of classical 
key distillable from a state equal to Kb- We will give to this question a positive answer now. It means, that distilling private 
dits i.e. states of the form (1241 is the best way of distilling classical key from a quantum state. 

B. Distillable classical secure key: LOPC paradigm 

The issue of drawing classical secure key from a quantum state is formally quite different from the definition of drawing 
pdits. However it will turn out that it is essentially the same thing. In the LOCC paradigm, we have an initial state p hold by 
Alice and Bob who apply to it an LOCC map, and obtain a final state p'. Thus the LOCC paradigm is essentially a bipartite 
paradigm. 

In the paradigm of drawing secure classical key (see e.g. [12], [13]), there are three parties, Alice, Bob and Eve. They 
start with some joint state pabe where subsystems A, B, E belong to Alice, Bob and Eve respectively. Now, Alice and Bob 
essentially perform again some LOCC operations. However we have now a tripartite system, and we should know how that 
operation act on the whole system. 

Definition 7: An operation A belongs to LOPC class if it is composition of 

(i) Local Alice (Bob) operations, i.e. operations of the form (gi Ibe (or A# ® Iae)- 

(ii) Public communication from Alice to Bob (and from Bob to Alice). E.g. the process of communication from Alice to Bob 
is described by the following map 

MPaABE) = P iPaAB E Pi ® \i)b(*\ <8> |*) e (i| (105) 
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where Pi = Iabe <8> |*)a(*|- Here the subsystem a carries the message to be sent, and the subsystems b and e of Bob and 

Eve represent the received message. 
Let us note, that LOCC operations can be defined in the same way, the only difference is that we drop Eve's systems (both 
E and e) and corresponding operators. 

Now, drawing secure key means obtaining the following state 

d-1 

P ideal 



=J2 \\ii){ii\AB®p E (106) 



d' 

by means of LOPC. Since output states usually can not be exactly p^ al Alice and Bob will get state of the ccq form i.e. 

d 

PrZ= £j»«|ii)AB(y|®^ (107) 

There are two issues here: first, Alice and Bob should have almost perfect correlations, second, Eve states should have small 
correlations with states \ij) of Alice and Bob systems. The first condition refers to uniformity, the second one to security. 
There are several ways of quantifying these correlations, and some of them are equivalent. To quantify security [3] one can 
use Holevo function of distilled ccq state, namely: 

d 

x(Pccq) = S{p E ) - ^2 PijS(pij) < e (108) 
where S(p) — Trplogp denotes von Neumann entropy, and 

d 

PE= Y2 PijPiJ- ( 109 ) 

Alternatively, one can use similar condition based on norm 

Y^PiiWPE - P%\\ < e (110) 

y 

The condition of maximal correlations between Alice and Bob (uniformity) can be of the following form 

d ^ d 

II £j*,M<tfl- j£l«><«lll<e cm) 

One can also use again the trace norm between the real state ( 1107b that is obtained and the ideal desired state (11061 ) as done 
in [19], which includes both maximal correlations condition as well as security condition. The condition says that the state 
PTeai obtained by Alice and Bob is closed to some ideal state 

l»-&ll<e (112) 

We will discuss relations between this condition, and security criteria ( 1108b and (II 101 ) as well as with uniformity criterion 
(fTTTb in Appendix IXV-Cl . 

For the purpose of definition of secret key rate in this paper, we apply the joint criterion (II 12b . Consequently, we adopt the 
following measure of distillable classical secure key from a quantum tripartite state: 

Definition 8: For any given state pabe £ B(Ha ® "Hb ® He) l e t us consider sequence P n of LOPC protocols such that 

Pn(pABE) = Pn> where Pn is cc q state 

dn-l 
i,3=0 

from B(H (n) ) = B{n { ^ ® ® H^) with dimH^ l) = dimft£° = d n . A set of operations V = U™ =1 {P n } is called 
classical key distillation protocol of state pab if there holds 

lim |K-/3 d „|| = 0, (114) 

n— >oo 

where (3 d € B(H { - n) is of the form 

1 dn 

^-(X)l«)^<M|)®pf, (115) 

1=1 
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are arbitrary states from B (Hv), The rate of a protocol V is given by 



TZ{P) = limsup 



(116) 



Then the distillable classical key of state pabe is defined as supremum of rates 

Cd(pabe) = snpTZ(V). 



(117) 
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The above definition works for any input tripartite state Pabe- However in this paper we are only interested in the case 
where the total state is pure. The latter is determined by state pab — Tte Pab e up to unitary transformations on Eve's side. 
Since from the very definition Cd does not change under such transformations, the latter freedom is not an issue, so that we 
can say the state pab completely determines the total state. Thus we get definition of distillable classical secure key from 
bipartite state pab 

Definition 9: For given bipartite state pab the distillable classical secure key is given by 



where i^abe purification of pab- 

C. Comparison of paradigms 

Let us compare two definitions [6] and [9] of distilling cryptographical key. The difference is mostly that the first one deals 
only with bipartite system, and the goal is to get the desired final state by applying a class of LOCC operations. Within the 
second paradigm, we have tripartite state and we want to get a wanted state by means of LOPC operations. Thus the first 
paradigm is much more standard in quantum information theory. The second one comes from classical security theory (see 
e.g. [43]), where probability distributions of triples of random variables P(X, Y, Z) are being processed. 

In the next section we will see that if the tripartite initial state is pure, the two paradigms are tightly connected. In the case of 
distillation of exact key, they are almost obviously identical, while in the inexact case, the only issue is to make the asymptotic 
security requirements equivalent. We will see that an output pdit obtained by LOCC implies some ccq state obtained by LOPC, 
and vice versa. 

D. Composability issues 

In the present paper we consider the promised scenario, which is the first step to consider in unconditionally secure QKD. 
Q. The latter security definition is required to be universally composable, which means that a QKD protocol can be used as a 
subroutine of any other cryptographic protocol [4], [3], [47]. To this end, one needs to choose carefully the measure of security. 
Our starting point is the LOPC paradigm, where the measure of security is the trace norm. This is compatible with [3], where 
it was shown that such security measure implies indeed composability (see eq. (10) of [3]). In particular, if we concatenate n 
QKD protocols with security e measured by trace norm between the obtained state and the ideal target, the overall protocol 
will have security bounded by ne. Thus trace norm in LOPC paradigm can be called composable security condition. 

However, we want to recast QKD within the LOCC paradigm, i.e. in terms of distance between Alice and Bob states rather 
than tripartite states. In this spirit, in [3] it is shown that fidelity with maximally entangled state implies composability, in the 
sense that if fidelity is 1 — e then the norm is bounded by ^[i (see eq. (20) of [3]). This may seem a bit uncomfortable, because 
while composing many protocols we have now to add not epsilons, but rather their square roots. However one can see that 
it is in general not possible to do better while starting from fidelity. Due to inequality 1 — F(a, p) < h\\p— aj| [26] we can 
equally well use the trace norm. Indeed it will give us at worse the y/e bound for composable security condition in the LOPC 
paradigm. 

In our paper we have a more general situation, i.e. we deal with distance to private states rather than just maximally entangled 
states. According to the above discussion, we have decided to use trace norm in LOCC scenario. In our techniques, in the 
mid-steps we shall use fidelity, hence we are again left with y/e. We do not know, whether one can omit fidelity, and get rid 
of the square root. 

Having said all that, we should emphasize that finally the minimal requirement is that security is an exponentially decreasing 
function of some security parameter, whose role can play e.g. the number of all qubits in the game. This condition is of course 
not spoiled by square root. (Example of a situation, where this requirement is not met was conjectured in [3] and then proved 
in [41]). In our paper we shall derive equivalences between various security conditions, and the word "equivalence" will be 
understood in the sense of not spoiling the proper exponential dependence on total number of qubits. In particular, the security 
conditions will be called equivalent also when they differ by the factor polynomial in number of qubits (see e.g. [30]). 

'The next step was subsequently done in papers [33], [32] 



Cd{pab) = Cd{iPabe) 



(118) 
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IX. Equality of key rates in LOCC and LOPC paradigms 

In this section we will show that definitions [6] and [9] give rise to the same quantities. In this way the problem of drawing key 
within original LOPC paradigm is recast in terms of transition to a desired state by LOCC. First we will describe a coherent 
version of LOPC protocol. Then we will use it to derive equivalence in exact case (where protocols produce as outputs ideal 
ccq states or ideal pdits). Subsequently we will turn to the general case where inexact transitions are allowed. 

A. Coherent version of LOPC key distillation protocol 

The main difference between LOPC and LOCC paradigms is that in the first one we have transformations between tripartite 
states shared by Alice, Bob and Eve, while in the latter one - between bipartite states shared by Alice and Bob. Thus in 
LOPC paradigm, the part of the state held by Alice and Bob does not, in general tell us about security. To judge if Alice and 
Bob have secure key we need the whole pabe state. Security is assured by the lack of correlations of this state with Eve. 
Thus if we want to recast the task of drawing key in terms of LOCC paradigm, we need to consider such LOCC protocol 
which produces output state that assure security of key itself. We will do this by considering coherent version of LOPC key 
distillation protocols (cf. [40], [19]). 

The most important feature of the version will be that given any LOPC protocol, starting with some initial pure state ipABE 
and ending up with some ccq state pabe, its coherent version will end up with a state iP'aa'BB'E sucn tnat tracing out A'B' 
part will give exactly the ccq state pabe- In this way, the total Alice and Bob state paa'BB' will keep the whole information 
about Eve (because up to unitary on Eve's system, purification is unique). 

In coherent version of key distillation protocol Alice and Bob perform their local operations in a coherent way i.e. by 
adding ancillas, performing unitary transformations and putting aside appropriate parts of the system. This additional part 
of the system is discarded in the usual protocol. However, holding this part allows one to keep the total state of Alice Bob 
and Eve pure in each step of the protocol. This is because we use pure ancillas, pure initial state and apply only unitary 
transformations which preserve purity. 

Alice and Bob can also perform public communication. Its coherent version is that e.g. Bob and Eve apply C-NOT operations 
to Alice's subsystem which holds the result of measurement. 

Formally, the coherent version of process of communication from definition [7] is an operation of the form 

MPaABE) = U(p a ABE <8 |0) o /(0|® |0) 6 <0|® |0) e (0|)[/t (119) 

where 

U = I ABE ® ® U *' ® U b ] ® U e ] (120) 

i 

with unitary transformation Ue Jjfp satisfying Ui |0) e = \i) e and similarly for uff , . To finalize the operation, Alice 
puts aside the system a'. 

Such a coherent version of LOPC protocol has the following two features: (i) keeps the state pure, (ii) after tracing out 
subsystems that are put aside we obtain exactly the same state as in the original protocol. 

Now we are in position to construct for a given LOPC protocol a suitable LOCC protocol, which will output pbits when 
the former protocol will output ideal key. Namely, the local operations from LOPC protocol, we replace with their coherent 
versions. The public communication we take in original - incoherent - form (of course, without broadcast to Eve since we now 
deal with bipartite states). One notes that such operation produces the same state of Alice and Bob as the one produced by 
coherent version of the original LOPC protocol traced out over Eve's system. This is because, if we trace out Eve, then there 
is no difference between coherent and incoherent versions of public communication. 

Thus from an LOPC protocol we have obtained some LOCC protocol - a special one, where local systems are not traced 
out. In this way one gets a bridge which joins the two approaches, and shows that different definitions of distillable key are 
equivalent. In particular, suppose that the LOPC protocol produced the ideal ccq state. Then the output of LOCC protocol 
obtained as a coherent version of this protocol will produce a state which (due to theorem [2]) must be a pdit. 

Remark 3: Of course, the notion of coherent version need not concern just some LOPC protocol. Also an LOCC operation, 
that contained measurements and partial traces can be made coherent, which in view of the above considerations means 
simply, that the systems are not traced out, but only "kept aside" and measurements are replaced by appropriate local unitaries. 
Actually, if we include all pure ancillas that will be added in the course of realizing the LOCC operation, the coherent version 
of the operation is nothing but a closed LOCC operation [37] introduced for sake of counting local resources such as local 
information. One can think of the shield part, as being the state of all the lab equipment and quantum states, left over from 
the process of key distillation. 
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B. Equivalence of paradigms: The case of exact key 

Here we will consider the ideal case, where the distillation of the key gives exactly the demanded output state. One can 
state it formally and observe: 

Proposition 5: Let Kff act and Cff act denote optimal rates achievable by LOPC and LOCC protocols which as outputs 
have exact ccq states j 106b and pdit states d24b . respectively. Then for any state pab we have 

KW aCt (PAB) = C e D XaCt (pAB) (121) 



Proof: If after LOPC protocol V, Alice and Bob obtained exact d x d ccq state J106I ), then the coherent application of V 
due to theorem |2] and discussion of section HX- Al will produce pdit of the same dimension. Conversely, if by LOCC Alice and 
Bob can get a pdit, then after measurement, again by theorem |2j they will obtain exact ccq state ( 11061 l of the same dimension. 



C. Distillation of classical key and distillation of pdits - equivalence in general ( asymptotically exact) case 

We will prove here the theorem, which implies, that even in nonexact case, distillation of pdits from initial bipartite state 
by LOCC is equivalent to distillation of key by LOPC from initial pure state, that is purification of the bipartite state. This in 
turn means that the rates in both paradigms are equal. 

Theorem 5: Let Alice and Bob share a state p such that Eve has it's purification. Then the following holds: if Alice and 
Bob can distill by LOPC operations a state such that with Eve's subsystem it is ccq state i.e. of the form 

d 

PABE = ^2 P«I*J)(*JUb ® Pfv ( l2T> 

with \\pabe ~ PidlaiW — £ ' tnen diey can distill by LOCC operations a state p out which is close to some pdit state 7 in trace 
norm: 

\\Pout - j\\ < V2~e, (123) 
where the key part of a pdit 7 is of dimension d x d. 

Conversely, if by LOCC they can get state p out satisfying \\p ut — 7|| < e> then by LOPC they can get state p ccq satisfying 

WpTbe-pZU\<^ 

Proof: The "if part of this theorem is proven as follows. By assumption Alice and Bob are able to get by some LOPC 
protocol V a ccq state pabe satisfying 

\\PABE-PulalW<^ (124) 

Now by equivalence between norm and fidelity (Eq. ( fT3T > of Appendix) we can rewrite this inequality as follows 

1 

— ( 

2 

By definition of fidelity 

F(p,a) = max | (<ip\<f>) | (126) 

where maximum is taken over all purifications ip and <fr of p and a respectively, we can fix one of these purification arbitrarily, 
and optimise over the other one. Let us then choose such a purification ipABA'B'E of P^be which is die output of coherent 
application of the mentioned protocol V . There exists purification 4>abA'B'E of pideai such that it's overlap with rp is greater 
than 1 — |e. Since the fidelity can only increase after partial trace applied to both the states, it will be still greater than 1 — 
once we trace over Eve's subsystem. Thus we have 

1 

— ( 

2 

where o-^ ABA , B , and p\ BA , B i are partial traces of <fi and ifi respectively. The state o' ABA , B , (partial trace of 0) comes from 
purification of an ideal state, and by the very definition it is some pdit state 7. At the same time, the state p\ BA i B , (partial 
trace of ip) is the one which is the output of coherent application of protocol V. Thus by coherent version of V Alice and 
Bob can obtain state close to pdit which proves the "if part of the theorem. 

To obtain equivalence let us prove now the converse implication. The proof is a sort of "symmetric reflection" of the proof 
of the previous part. 

This time we assume that there exists LOCC protocol starting with p, ending up with final state p out with key part od d x d 
dimension which is close to some pdit in norm i.e. 

\\pout-l\\ <€. (128) 



F0>iBA>B>,<r$BA>B>)>l-^- (127) 
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Due to equivalence between fidelity and norm, we have 

F( P out,j) > l-e/2 (129) 

The total state after protocol is tpABA'B' e, and if partially traced over Eve it returns p ou t- Then we can find such 4>, purification 
of 7, that F(ip, (f) > 1 — e. Now let Alice and Bob measure the key part and trace out the shield. Then out of ip we get some 
ccq state p c ^ t . The same operation applied to <\> gives ideal ccq state (1106b p^l at - The operation can only increase the fidelity, 
so that 

F(p C oZ,P7 d lal)> 1-^/2 (130) 



Returning to norms we get 



\p c oZ-pT d Li\\<^- (13D 



X. Distilling key from bound entangled states 

In this section we will provide a family of states. Then we will show that for certain regions of parameters they have positive 
partial transpose (which means that they are non-distillable). Subsequently, we shall show that out of the above PPT states 
one can produce, by an LOCC operation, states arbitrarily close to pbits (which also implies that they are entangled, hence 
bound entangled). More precisely, for any e we will find PPT states, from which by a LOCC protocol, one gets with some 
probability a state e-close to some pbit. Since LOCC preserves the PPT property, this shows that pbits can be approximated 
with arbitrary accuracy by PPT states, in sharp contrast with maximally entangled states. We then show how to get from a 
state sufficiently close to a pbit with non vanishing asymptotic rate of key. We obtain it by reducing the problem to drawing 
key from states that are close to the maximally entangled state. 



A. The new family of PPT states ... 

Here we will present a family of states, and will determine the range of parameters for which the states are PPT. The idea 
of construction of the family is based on the so called hiding states found by Eggeling and Werner in [22]. Let us briefly recall 
this result. In [52], [20] it was shown that one can hide one bit of information in two states by correlating the bit of information 
with a pair of states which are almost indistinguishable by use of LOCC operations, yet being almost distinguishable by global 
operations. The resulting state with the hidden bit is of the form: 

Ph b = l\0)(0\ A B®pl dmg + \\l)(l\®pl ldmg (132) 
In [22] it was shown that there are separable states, which can serve as arbitrarily good hiding states. These states are 

ri = ( P 1 +Pa )8fcj T2 = {ps f^ (133) 

where p s and p a are symmetric and antisymmetric Werner states (1501 . The higher is the parameter k, the more indistinguishable 
by LOCC protocols the states become. 

We adopt the idea of hiding bits to hide entanglement. Namely instead of bits one can correlate two orthogonal maximally 
entangled states with these two hiding states and get the state: 

Phe = \\^+)^+\ab ® rf B ' + ^-)<V-Ub ® rf B ' (134) 

Let us recall, that our purpose is to get the family of states which though entangled are not distillable, and can approximate 
pdit states. Then the choice of ph e as a starting point has double advantage. First, because t\ and T2 are hiding, pi ie will not 
allow for distillation of entanglement by just distinguishing them. Second, the hiding states are separable, so they do not bring 
in any entanglement to the state ph e - However the state (1134b is obviously NPT Indeed, consider partial transposition of BB' 
system. It is composition of partial transpositions of B and B' subsystems. If one applies it to the state ( 1134| i, one gets 

PABA'B' = {I A ®T B (g) I A' O Tgi ) {pABA'B' ) = 

" i( 1 4^) r 

hi^T^f 

|( n ^) r 

i( I1 T^) r . 

(135) 
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where V denotes partial transposition over subsystem B' (as partial transposition over B caused interchange of blocks of matrix 
of ( 1 1341 )). This matrix is obviously not positive for the lack of middle-diagonal blocks. To prevent this we admix a separable 
1 10) (10 1 ) ® t 2 with a probability (1 — 2p), where p £ (0, h]. It's matrix reads then 



state |(|01)(01| 



P( P ,d,k) 



p( 2 



~ ) 






Pi***) 





ih~p)^ 









{k-P)T2 





p(- 



p( 






Tl+T 2 



(136) 



In subscript we explicitly write the parameters on which this state depends implicitly: d = d,A> = cLb' is the dimension of 
symmetric and antisymmetric Werner states used for hiding states ( 1133b and k is parameter of tensoring in their construction. 
We shall see, that for some range of p, almost every state of this family is a PPT state. We formalise it in the next lemma. 



Lemma 5: Let 
k be such that 



Pa 



£ B(C d <g> C d ) and 



Pb 



£ B(C d <g)C d ) be symmetric and antisymmetric Werner states respectively, and let 

Pa \(g>k 



Tl 



Ps 



T2 = (Ps 



(137) 



holds. Then for any p £ (0, ^ 
the state (1136 



and any k there exists d such that state ( 1136b has positive partial transposition. More specifically, 
is PPT if and only if the following conditions are fulfilled 

1 



<p< 



(138) 



1-p 



> 



For the proof of this lemma see Appendix IX V-B I 



B. ... can approximate pdits 

We have just established a family P[ p ^.k) sucn that for certain p, k and d they are PPT states. We will then show, that by 
LOCC one can transform some of them to a state close to pbits. More precisely, for any fixed accuracy, we will always find p, 
d and k such that it is possible to reach pbit up to this accuracy, starting from some number of copies of P(j,^d,k) an d applying 
LOCC operations. 

Subsequently, we will show that one can always choose the initial states P( p ^.k) to t" e PPT. Since LOCC operations do not 
change PPT property, we will in this way show that there are PPT states that approximate pbits to arbitrarily high accuracy. 
We will first prove the following theorem. 

Theorem 6: For any e > and any p £ (i 1] there exist state p from family of state {p( p ,d,k)} (11361 ) such that for some m 
from p® m one can get by LOCC (with nonzero probability of success) a state a satisfying \\a — j\ \ < e for some private bit 
7- 

Proof: First of all let us notice that by theorem H] it is enough to show, that one can transform p® m into a state p' which 
has sufficiently large norm of the upper-right block. 

Let Alice and Bob share m copies of a state p from the family (1136b . The number to and parameters (p, k, d) of this state 
will be fixed later. 

Now let Alice and Bob apply the well known recurrence protocol - ingredient of protocols of distillation of singlet states 
[8]. Namely they take one system in state p as source system, and iterate the following procedure. In i-th step they take one 
system in state p, and treat it as a target system. Let us remind that both systems have four subsystems A, B, A' and B'. To 
distinguish the source and target system, the corresponding subsystems of a target system we call A, B , A' , B' . On the source 
and target system they both perform a CNOT gate with a source at the A(B) part of a source system and target at A(B) 
part of a target system for Alice (Bob) respectively. Then, they both measure the A and B subsystem of the target system in 
computational basis respectively, and compare the results. If the results agree, they proceed the protocol, getting rid of the AB 
subsystem. If they do not agree, they abort the protocol. With nonzero probability of success they can perform this operation 
m — 1 times having each time the same source system, and some fresh target system in state p. That is they start with m 
systems in state p and in each step (upon success) they use up one system and pass to the next step. 

One can easily check, that the submatrices (blocks) of the state p r ( p c d fc ) which survives to — 1 steps of this recurrence protocol 
(which clearly happens with nonzero probability) are equal to the TO-fold tensor power of the elements of initial matrix p( Pt d,k)'- 



P&d,k) - N 



|p(2l±Zl)]®n, [P( n ^)} i 

[{\-p)T2)® m 

o " o [(i ~ P )T 2 f> m 

[ P ( T -^)f m o " o W-^)] 



<g>m 



(139) 
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where the normalisation is given by 

N = Tr[p^ fc) ] = 2p m + 2(1 - p) m . (140) 
Let us consider the upper-right block Aoon of the matrix ( 11391 ) without normalisation. Norm of this block is equal to 

l|ioon|| = (f) m ||(^y^r-^ fe || = 

(I)™ (2(1 -2- k )) m =p m {l-2- k ) m . (141) 

where second equality is consequence of the fact, that p a and p s have orthogonal supports which gives that pf k is orthogonal 
to any term in expansion of ( Pa l 2 P3 )® k but the one j^pf k - Thus the result is equal to norm of [( pa ~ Ps )® k — ^pf k ) (which is 
(1 — ^t)) plus norm of the difference \^pf k — pf | which gives the above formula. Thus the norm of the upper-right block 
Aioii °f the state ( 11391 ) is given by 

Poonll = ^IIoohII = \{l ^r i + (j ^ )m - (142) 

We want now to see, if we can make the norm to be arbitrary close to 1/2. (then by Lemma @] the state will be arbitrary close 
to a pbit). Since p > j, we get that {—^ p -) m converges to with m. Although increasing m diminishes the term (1 — ^r) m , 
we can first fix k large enough, so that the whole expression (1142b will be as close to h as it is required. ■ 

Now we have the following situation. We know that for p 6 (i 1] if i(l — — i-i P s m is close to 1/2, then the state 

l + ( 2p I 

(11391 ) is close to pbit. On the other hand, from lemma © it follows that for (i) p <G (0, 1/3] and (ii) > (^rj) the state 
P{v,d,k) is PPT hence also the state J 1 39b is PPT (because it was obtained from the former one by LOCC operation). If we 
now fix p from interval (1/4, 1/3], then by choosing high m and for such m, high enough k, then the state (11391 ) is close to 
pbit. Now, we can fix also m and k, and choose d so large that the condition (ii) is also fulfilled so that the state becomes 
PPT. This proves the following theorem, which is main result of this section. 
Theorem 7: PPT states can be arbitrarily close to pbit in trace norm. 

Here might be the appropriate place to note an amusing property of state ( 11341 ): Namely, Eve knows one bit of information 
about Alice and Bob's state - she knows the phase of their Bell state. But she only has one bit of information about their 
state, thus it cannot be that she also knows the bit of their state, which is the key. In some sense, giving Eve the bit of phase 
information, means that she cannot know the bit value. 



C. Distillation of secure key 

In the previous subsection we have shown that private bits can be approximated by PPT states. Now, the question is whether 
given many copies of one of such PPT states Alice and Bob can get nonzero rate of classical key. Below, we will give the 
positive answer. 

The main idea of the proof is to show that from the PPT state which is close to pbit Alice and Bob by measuring, can 
obtain ccq state satisfying conditions of protocol (DW) found by Devetak and Winter [19]. Namely, they have shown that for 
an initial cqq state (state which is classical only on Alice side; this includes ccq state as special case) between Alice, Bob and 
Eve, 

C d (pabe) > I (A : B) - I(A : E) (143) 
Here I(A : B) stands for the quantum mutual information of the state p with subsystems A and B given by 

I(A : B) = S(A) + S(B) - S(AB), (144) 

where S(X) stands for the von Neumann entropy of X (sub)system of the state p. 

Using the above result we can prove now, that from many copies of states close to a pbit, one can draw nonzero asymptotic 
rate of key. 

Lemma 6: If a state p is close enough to pbit in trace norm, then Ko{p) > 0. 

Proof: The idea of the proof is as follows. Suppose that a is close to pbit 7. We then consider twisting that changes 7 
into basic pbit P+* B <& (J A' B' with some state a on A'B' . We apply twisting to both states, so that they are still close to each 
other. Of course, this is only a mathematical tool: Alice and Bob cannot apply twisting, which is usually a nonlocal operation. 
The main point is that after twisting, according to theorem [T] the ccq state does not change. If we now trace out systems A' B' 
the resulting state will be close to maximally entangled, and the resulting ccq state - at most worse from Alice and Bob point 
of view (because tracing out means giving to Eve). What we have done is just privacy squeezing of the state p. Now, the 
latter ccq state has come from measurement of a state close to the maximally entangled one. Thus the task reduces to estimate 
quantities I(A : B) and I(A : E) for a ccq state obtained from measuring the maximally entangled state. However due to 
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suitable continuities, first one is close to 1 and second one close to 0. Now by DW protocol, one can draw a pretty high rate 
of key from such ccq state. Let us now proceed with the formal proof. 
We assume that for some pbit 7 we have 

||p- 7 ||<e. (145) 

Let us consider twisting U which changes pdit 7 into a basic pdit. Existence of such U is assured by theorem [2] If both states 
7 and p are subjected to this transformation, the norm is preserved, so that 

- UjU^\\ < e. (146) 

Also due to theorem [TJ the ccq state obtained by measuring key part of U pU^ is the same as that from p. Now, the amount of 
key drawn from such ccq state will not increase if we trace out shield. Thus we apply such partial trace to U pU^ and to 7, 
and by monotonicity of trace norm get 

\\pAB~Pi B \\<e. (147) 

It is now enough to show that from ccq state obtained by measuring pab (where Eve holds the rest of its purification) one 
can get nonzero rate of key. 

To this end let us note, that for ccq state obtained from any bipartite state pab by measuring its purification on subsystems 
A and B in computational basis, we have the following bound for I(A : E): 

I (A : E) ccq < S(pab). (148) 

Now, since our state pab is close to P+, for which S(P+) — and I (A : B) = 1, we can use continuity of entropy, to bound 
these quantities for the state. ^From Fannes inequality (see eq. [14] in Sec. Ill-Al l, we get 

/(A:B) ccq >l-4elog^ B -/i(e), (149) 
I(A : E) ccq < S{~ PAB ) <8e~ h(e). (150) 

To get first estimate, it is enough to note, that due to monotonicity of trace norm, the estimate (I1471 i is also valid if we dephase 
the state pab and Pab- Thus we obtain that 

K D (p) > I(A : B) - I(A : E) > 1 - 16e (151) 

This ends the proof of the lemma. ■ 

Let us note here, that it was not necessary to know, that the state p is close to pbit. Rather, It was enough to know that trace 
norm of upper right block is close to 1/2, as we have proved that it is equivalent to previous condition (see Sec. [V}. ^From 
this it follows, that after twisting, and tracing out A'B' the resulting state p is close to the EPR state, which ensures nonzero 
rate of key (actually the rate is close to 1). 

We now can combine the lemma with the fact that we know PPT states that are close to pbit, to obtain that there exist 
PPT states from which one can draw secure key. The states must be entangled, as from separable states one cannot draw key. 
Namely separable state can be established by public discussion. If it could then serve as a source of secret key, one could 
obtain secret key by public discussion which can not be possible. For formal arguments see [17]. Thus our PPT states are 
entangled. But, since they are PPT, one cannot distill singlets from them [36], hence they are bound entangled. In this way 
we have obtained the following theorem 

Theorem 8: There exist bound entangled states with Kp > 0. 

We have split the way towards bound entangled states with nonzero key into two parts. First, we have shown that from PPT 
states P(p 7 d,k) by recurrence one can get a state that is close to pbit. Then we have shown, that from a state close to pbit one 
can draw private key. 

Note that we have two quite different steps: recurrence was the quantum operation preformed on quantum Alice and Bob 
states, while Devetak- Winter protocol in our case, is classical processing of the outputs of measurement. We could unify 
the picture in two ways. First Alice and Bob could measure the key part of the initial state P( Pt d,k), and preform recurrence 
classically (since the quantum recurrence is merely coherent application of classical protocol). Then the whole process of 
drawing key from P( p _d,k) would be classical (of course, taking into account that Eve has quantum states). On the other hand, 
the DW protocol could be applied coheretly, so that till the very end, we would have quantum state of Alice and Bob. 

The result we have obtained allows to distinguish two measures of entanglement 

Corrolary 2: Distillable entanglement and distillable classical secure key are different measures of entanglement i.e. there 
are states for which there holds 

K D {p) > D{p) = 0. (152) 

In further section we will also show that Kd is different than entanglement cost, as it is bounded by relative entropy of 
entanglement. 
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XI. Relative entropy of entanglement as upper bound on distillable key 

In this section we will provide complete proof of the theorem announced [34] which gives general upper bound on distillable 
key K B . This upper bound is given by regularised relative entropy of entanglement (|56*1 >. The relative entropy of entanglement 
[55], [54] is given by 

E r {p) = inf S(p\a sep ), (153) 

where S(p\a) = Trplogp— Trp log a is relative entropy, and infimum is taken over all separable states a sep . The regularized 
version of E r is given by 

E r °»=lim r[P ' . (154) 

n n 

The limit exists, and due to subadditivity of E r , we have 

E™(p)<E r . (155) 

It follows that also relative entropy of entanglement is upper bound for K B . 

We recall now the following lemma obtained in [34], the proof of which we provide in Appendix IXV-HI 

Lemma 7: Consider a set S T := {Up AB A'B'U ] \paba>b> G SEP , paba'B' G B(C d (g> C d (g> C d *' ®C d B')} where U is 

S-twisting with B being a standard product basis in C d (g> C d . Let ct^ba'S' G S t and cols = Tr^/ B'&ABA'B' ■ We have then 

^(P+lffAfl) > logd, (156) 

where P + = \^+){^+\. 

We will also need asymptotic continuity of the relative entropy distance from some set of states obtained in [21] in the form 
of [50]. 

Proposition 6: For any compact, convex set of state S that contains maximally mixed state, the relative entropy distance 
from this set given by 

Ef = inf S(p\\a), (157) 

is asymptotically continuous i.e. it satisfies 

\Ef( Pl )-Ef{p 2 )\<Ae\ogd+h{e) (158) 

for any states pi, p 2 acting on Hilbert space H of dimension d, with e = \\p\ — p 2 \\ with e < 1. 

Let us mention, that the original relative entropy of entanglement [54] has in place of S the set of separable states. Another 
version has been considered in [46], where S was set of PPT states. The latter set has entangled states, but they can be only 
weakly entangled. In contrast we will have set in which there may be quite strongly entangled states. 

We are now in position to formulate and prove the main result of this section. 

Theorem 9: For any bipartite state pab G B(C dA ®C dB ) there holds 

K d ( P ab)<E™( Pab ), (159) 

Proof: By definition of Kd(pab) there exists protocol (i.e. sequence of maps A„), such that 

A„(^ n ) = l' d (160) 
where ^ 

T&m—=K D {p AB ) (161) 

n n 

and 

lim||7^-7 d || =lime„ = (162) 

n n 

with being pdit with dimension d 2 of the key part. 

We will present now the chain of (in)equalities, and comment it below. 

S(PA B \Vsep) > S(j ABA , B ,\<T se p) = (163) 

= S(U^' ABA , B ,Ul\U 7 a sep Ul)> (164) 

> S(TtA>B>\UWABA>B>ty]\^A>B>\Ui<r.epU§) (165) 

= S(P' + \a)> (166) 

> inf aeT S(P^\a) := E^{P' + ) > (167) 

> <(p + )-4||p + -p;i|io g d-/i(i|p + - J p;ii) > (168) 

> (1 -4e n ) log d-h(e n ) (169) 
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Inequality J 163b is due to the fact, that relative entropy does not increase under completely positive maps; in particular it 
can not increase under LOCC action applied to it's both arguments (second argument becomes other separable state since 
LOCC operations can not create entanglement). In the next step, Eq. d 1 64-t we perform twisting U 1 controlled by the basis in 
which state j m is secure (without loss of generality we can assume it is standard basis). The equality follows from the fact 
that unitary transformation doesn't change the relative entropy. Next (1165b we trace out A'B' subsystem of both states which 
only decreases the relative entropy. After this operation, the first argument is P' + , which is a state close to the EPR state P+. 
(Pi would be equal to the EPR state if "y'^g^/gi were exactly pdit) while second argument becomes some - not necessarily 
separable - state a. The state belongs to the set T constructed as follows. We take set of separable states on system ABA' B' 
subject to twisting U 1 and subsequently trace out the A'B' subsystem. The inequality ( 1166b holds, because we take infimum 
over all states from set T of the function S(P+\a). This minimised version is named there Ej (PL) as it is relative entropy 
distance of P' + from the set T. 

Let us check now, that set T fulfills the conditions of proposition [6] Convexity of this set is obvious, since (for fixed unitary 
£/ 7 ) by linearity it is due to convexity of the set of separable states. This set contains the identity state, since it contains 
maximally mixed separable state which is unitarily invariant (i.e. invariant under U 1 ) and whose subsystem AB by definition 
is the maximally mixed state as well. Thus by proposition [6] we have that Ej is asymptotically continuous 

\Ej{P' + )-Ej{P+)\ <||P;-P + ||41ogd + /i(||P;-P + ||), (170) 

where we assume that the EPR state P+ is of local dimension d. Since P' + and P+ come out of j' AB and 7d by the same 
transformation described above (twisting, and partial trace) which doesn't increase norm distance, by ( 1162b we have that 
1 1 Pi — P+|| < e n . This, together with asymptotic continuity (1170b implies ( 1167b . Now by lemma [7] we have 

Ej(P+)>\ogd, (171) 

which gives the last inequality: 

Ej(P' + ) > (l-4e n )logd-/i(£n)- (I 72 ) 
Summarizing this chain of inequalities (1163b - dl68b . we have that for any separable state a sep : 

S(p%\\vse P ) > (l-4e„)logd-/i(e n ) (173) 
Taking now infimum over all separable states a sep we get 

EApTb) > (l-4e„)logd-/i(e n ). (174) 

Now we divide both sides by n and take the limit. Then the left-hand-side converges to E^° . Due to ( 1162b e n — > and due 
to (1161b . log d/n — > Kd(pab)- Thus due to continuity of h we obtain 

Py°° > K D (175) 

■ 

As an application of the above upper bound, we consider now the relation between distillable key and entanglement cost. 
For maximally entangled states these two quantities are of course equal, unlike for general pdits. As an example let us consider 
again a flower state given in eq. ( BTl ). As follows from [31], the flower state has Ec strictly greater than the relative entropy 
of entanglement. Since by the above theorem we have K D (j f i ower ) < E r (j flower ), havig E r (j f i ower ) < E c (jfiower), we 
obtain in this case K D (j f i ower ) < E c (jfiower)- 

Let us note, that the entanglement monotone approach initiated here was then used in full extent in [13], [14]. It is shown 
there, that in fact any bipartite monotone E, which is continuous and normalized on private states (i.e. E(jd) > logd), is an 
upper bound on distillable key. In particular it is shown that the squashed entanglement [53], [15] is also an upper bound on 
distillable key. 

XII. A CANDIDATE FOR NPT BOUND ENTANGLEMENT 

Thus far, all known bound entangled states have positive partial transpose (are PPT). A long-standing and interesting open 
question is whether there exist bound entangled states which are also NPT. If such states existed, it would imply that the 
quantum channel capacity is non-additive. Since any NPT state is distillable with the aid of some PPT state [57], we would 
have the curious property that one can have two states which are each non-distillable, but if you have both states, then the 
joint state would be distillable. 

We now present a candidate for NPT bound entangled states which are based on the states of equation (1134b . 

Phe = \\^+)^+\ab <8> rf B ' + ^_)<</>_U B ® rf B ' (176) 

and which intuitively appear to be bound entangled. Globally, the flags rf- B , are distinguishable, but under LOCC the flags 
appear almost identical, thus after Alice and Bob attempt to distinguish the flags, the state on AB will be very close to an 
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equal mixture of -0+ and ip_. The equal mixture of only two different EPR states is separable in dimension 2x2, but it is 
at the edge of separability. A slight biasing of the mixture, causes the state to be entangled. Thus, if Alice and Bob are able 
to obtain even a small amount of information about which r, they have, they will have a distillable state. More explicitly, if 
Alice and Bob attempt distillation by first guessing which hiding state flag they have, and then grouping the remaining parts 
of the states into two sets depending on their guess of the hiding state, they will be left with states of the form 

p h e = {\+e)\i, + ){i> + \ AB + {~t)\i>-){il>-\ AB . (177) 

This state is distillable. 

But what if we mix in more than two different EPR states? Namely, instead of only considering hiding states (flags) correlated 
to odd parity Bell states (anti-key states) \ip±) = ( 1 01) ± |10)), we also add mix in flags correlated to the even parity Bell 
states (key type states) \<f>±) = 4|(|00) ± |11)). Consider: 

p =p 11 \(p + )((p + \ ®pu +pi 2 |0_)(0-| ® Pl2 + 

+P 2 l\lp+)(lp+\ ® P21 +P22\tp-){tp-\ ® P22 (178) 



where 



Pij 



(179) 



Let us take for example, all pij = 1/4. Then, after attempting to distinguish the hiding states, Alice and Bob will have a state 
which is very close to the maximally mixed state (i.e. the state will be very close to a mixture of all four Bell states). The 
maximally mixed state is very far from being entangled, thus even if Alice and Bob's measurements on the hiding states are 
able to bias the mixture away from the maximally mixed state, the state will still be separable. 

Intuitively, it is thus clear why the state of equation ( 11781 ) will not be distillable. Any protocol which attempts to first 
distinguish which Bell state the parties have, will fail. But is the state entangled? Indeed it is, in fact it has negative partial 
transpose. To see this, we look at the block-matrix form of the state 



T 2 ) T 2 <g> (Tl 

t 2 ) t 2 <g> (ti 




1 

P =4 



ri <g> (n + r 2 ) o 

T 2 <g> (Tl 

T 2 ® (Tl 

ti ® (ti - r 2 ) 



T2) 
T2) 



Tl ® (Tl 




Tl ® (Ti 



T2 



T 2 ) 



(180) 



If the matrix were PPT we would have in particular 



® (Tf + T 2 r ) > 



(181) 



We will argue that it is not true. Let us recall that 



d 2 - 1 

P+ , (l + W 
<P + 



d 2 



Pi 



d 2 +d 

' \ {d 2 - l) k ~ (d 2 + d) k 



R 



(Pf)® fe 



1 



(d 2 -l) k (d 2 + d) k 



where we use notation from sec. XI. To see that (1181b is not satisfied we consider the following projector 

Q = I - {P^) m 

i.e. Q is projector onto support of positive operator R. Since Tr(Qrf ) = 0, we have 



Moreover we have 



Tr[(Q ® (P±r k )(T[ ® (t[ + r 2 r ))] = 
Tr(Q®(P^)® fe )[r 2 r ®(T 1 r -T 2 r )] = 



= TtR 



(d 2 - l) k (d 2 + d) k 

The above quantity is strictly greater than zero for d > 2. Thus inequality ( 11811 l is violated on projector Q ® (P^:)® fe . 



(182) 
(183) 
(184) 

(185) 
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Now, it may be that there is a protocol which succeeds in distilling from the state ( 1178t which does not rely on first 
performing a measurement to distinguish the hiding states. However, even taking many copies of the state, produces a state of 
the form 

P = ^I^}(^I®P* (186) 

i 

with the pi being binary strings encoded in hiding states and ipi being the basis of maximally entangled states. Thus the form 
of the state is invariant under tensoring. There is thus a very strong intuition that these states are NPT bound entangled, and 
a very good understanding of why they might be so. Effectively, the partial transpose does not feel very strongly the fact that 
the states p are hiding states, but more strongly feels the fact that they are globally orthogonal. 

XIII. Controlled private quantum channels 

Here, we demonstrate a cryptographic application of bound entangled states which have key. A private quantum channel 
(PQC)[10], [44] allows for the sending of quantum states such that an eavesdropper learns nothing about the sent states. Here, 
we consider the cryptographic primitive of having the ability to securely send quantum states (a PQC), but that this ability 
can be turned on and off by a controller. Namely, we consider a three party scenario (Alice, Bob, and the (C)controller) and 
demand 

• Alice and Bob have a private quantum channel, which they can use to send an unknown qubit from one to the other in 
such a way that they can be sure that no eavesdropper (including the Controller), can gain information about the state 
being sent. 

• the Controller has the ability to determine whether or not Alice and Bob can send the qubit 

We now show that this can be done using shared quantum states in such a way that the Controller only needs to send classical 
communication to one of the parties in order to activate the channel. First, let us note that the standard way of controlling the 
entanglement of two parties is via the GHZ state 

\f)ABC = |000) + |111) . (187) 

If the Controller, (Claire), measures in the basis |0) ± |1), then, depending on the outcome, Alice and Bob will share either 
the Bell state \ip+) or \4>~). If C then tells them the result, they will have one unit of entanglement (ebit) which they can 
then use to teleport quantum states. However, if the Controller wants to give them the ability to send a single qubit securely, 
then the GHZ state cannot be used for this, because the Controller can trick Alice and Bob into sending part of the quantum 
state to her. She can claim that she obtained measurement outcome +, when in reality she has not performed a measurement 
at all. Then, when Alice attempts to teleport a qubit to Bob, she is in fact teleporting to both Bob and the Controller. The 
controller can then perform a measurement on her qubit to obtain partial information about the sent qubit. Note that here we 
are concerned with the ability to give single shot access to a quantum channel. If the controller gives Alice and Bob many 
ebits by performing measurements on many copies of a GHZ state, then Alice and Bob could always perform purity testing 
to determine that the Controller is honest. 

Let us know show that unlike the GHZ, the states of Eq. ( 11341 ) can be used in such a way that the Controller can give 
Alice and Bob single shot access to a private quantum channel, in such a way that Alice and Bob are sure that the Controller 
cannot obtain any information about the sent states even when the Controller cheats. We will then show that we can do the 
same thing with fully bound entangled states, so that Alice and Bob possess no distillable entanglement unless the Controller 
gives it to them. 

First, we assume the shared state as a trusted resource. I.e. a trusted party gives Alice, Bob and the Controller some state 
which they use to implement the primitive. This assumption can be removed in the limit of many copies, since if Alice and 
Bob have many copies of the state, they can perform tomography to ensure that they indeed possess the correct state. The 
state we initially use is the purification of Eq. ( 1134b 

Phe = \\^+)^+\ab ® rf B ' + ^-)<V-Ub ® 4' B ' (188) 

Namely, 

WABC = |00) AB ® \<hU'B'C + |H>AB ® \^)A'B'C (189) 

such that Tr c(\<f>i){<Pi\) = n. 

Thus, (4>i\4>2) = and since the t% are orthogonal, the Controller's states Tr A>B'(\<f>i){<f>i\) = <Tq will be orthogonal. The 
controller can thus give Alice and Bob one ebit by performing a measurement to distinguish the a l c . She then tells Alice and 
Bob the result. Alice and Bob on the other hand, are guaranteed security by the fact that they either possess the state 
or \ip~). I.e. it is an incoherent mixture of the two states, and they either have one of the states or the other, they just don't 
know which one they have. 

The state of Eq. d 1 34t however, does have an arbitrarily small amount of distillable entanglement. Thus, Alice and Bob will 
have access to a private quantum channel in the case of having many copies of the state. If we want to give full control to 
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Claire, we need to ensure that the state held by Alice and Bob in the absence of Claire's communication is non-distillable. 
This can be achieved by using the bound entangled states of equation (1139t which approximate a pbit. It is not hard to verify, 
by explicitly writing the state in the Bell basis on AB, that the state is arbitrarily close to a state of the same form as equation 
( 11891 ), and thus has the desired properties. 



XIV. Conclusion 

We have seen that one can recast obtaining a private key under LOPC in terms of distilling private states under LOCC. One 
finds a general class of states which are unconditionally secure. This class includes bound entangled states from which one 
cannot distill pure entanglement. This then enables one to use tools developed in entanglement theory to tackle privacy theory. 
For example, the regularized relative entropy of entanglement was found to be an upper bound on the rate of private key. 

Many open questions remain. The most important problem in this context is whether all entangled states have non-zero 
distillable key or opposite - if there are bound entangled states which cannot be distilled into private states. One can also ask 
about the private state cost K qc of states pab- I.e. what is the dimension d of the key part of the pdit that is required to create 
Pab under LOCC? It might even be that K qc = Kj, which would enable entanglement theory to have basic laws along the 
lines of [38]. 

The question of reversibility of creating states from private states touches another "qualitative" problem, namely how tight 
is the upper bound on distillable key which is the regularised relative entropy of entanglement. 

Exploring the wide class of private states especially in the context of the well established theory of distillation of entanglement 
appears to be a necessary step in order to solve the above important problems. 



XV. Appendix 

A. Derivation of formula ( 1961 ) of Sec. [W] 

We show that a bipartite state of four subsystems ABA' B' given as 

PAB A'B' = ]T \ij)AB{i'j'\ ® Afl, (190) 
iji'j' 

where A^yy are block matrices can be written as 



PABA'B' = VPi3Pi'f\ i 3)AB{i'j'\ ® [Uij \j P E \J Pe 'U\, '. (191) 

iji'j' 

To see this, we first write down its total purification: 

^ABA'B'E = y^,y/Pij\ij)AB\'4>ij)A>B>E- (192) 

ij 

The states i^A'B'E can ^ e written as 

"'A'B 1 

^A'B'E = X k^ 3 \ k )A'B' <8> U t3 W\k) A 'B' (193) 



fe=l 

Here Uij is unitary transformation acting on Eve's system, Vij is unitary transformation acting on shield A'B' and W is some 



fixed embedding of Ha'B' into He (this is needed if Eve's systems are greater than the system A'B'): 

W:H A 'B'^n El W\k) A > B/ = \k) E (194) 

where \k) A 'B',k = 1, . . . ,d A 'B' is a fixed basis in system A'B', while \k)E, k = 1, . . . , (Ie is a fixed basis in system E. We 
will also need a dual operation, which is fixed projection of space He into Ha'B'- 

W u .He^H A 'B', (195) 

with 

W^\k) E = \k) A 'B' for k = l,...,d A ' B ' (196) 

Wt|fc) B =0 for k>d A , B , (197) 



One then finds that 



(Aiji'ff - (198) 
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where T is matrix transposition. One can find, the operator Ujj = UijWVij maps the space H.a>b> exactly onto a support of 

in space He, and the dual operator Uij = V^W^U^ maps the support of p 1 ^ back to TLa'B'- Finally, our state is of the 
form 



PABA'B' = 




(199) 



iji'j' 

which we aimed to show. 



B. The proof of lemma [5] Section \X-A\ 

We prove now that the states from a family that we have introduced in eq. (1136b . are indeed PPT for certain range of 
parameters, as it is stated in lemma [5] 

Proof: The matrix of the state (1136b after partial transposition has a form 



r 

Paba'B' 











(i~p)T 2 r 

p(^) r (i-p)r 2 r 







p(^) r 



(200) 



Since t\ and r 2 are separable (and hence PPT), so is their mixture. Thus extreme-diagonal blocks of the above matrix are 
positive. It remains to check positivity of the middle block matrix. Since any block matrix of the form 



A B 
B A 



(201) 



is positive if there holds A > \B\ where A and B are arbitrary hermitian matrices, our question of positivity of ( 12001 > reads 

-) r | (202) 



{-^-pM >P\( — 2" ' 



Having p s = -jt^{I + V) and p a = (I — V) where V swaps d-dimensional spaces and applying V v = dP + one easily 
gets that 



Pi 
d 2 - 1 

d 2 + d 



(1 + d)P+ 
d 2 +d 



(203) 



(204) 



where P^r = I — P + is projector onto subspace orthogonal to the projector onto maximally entangled state P + = \tp + )(ip + \. 
We check then the inequality 



(\-p) 



. P 
> - x 
- 2 



Pi 



(1 + d)P 



d 2 + d 

Pi 
d 2 - 1 



d 2 + d 
Pi 



> 

(1 + d)P+ 

d 2 + d~ t ' d 2 + d 



(205) 



To solve this inequality it is useful to represent the term on LHS as a sum: 



Pi 
d 2 + , 



(l + d)P+ 
d 2 +d 



Pi 



d 2 



R 



(206) 



where operator R is an unnormalised state which consists of all terms coming out of fc-fold tensor product of 



p+ . (i+d)p+ 

d7+d ~ d' 2 +d 



apart from the first term y d2+d 
to omit the modulus and to get 



It is good to note that R has support on subspace orthogonal to (P^:) (8fe . This fact allows 



(\-p) 



Pi 



d 2 



R 



> 



> 



P 



{Pif 



(d 2 - i) k (d 2 + d) k 



R 



(207) 
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Since R and (P+)® k are orthogonal, this inequality is equivalent to the following two inequalities 

{\ ~ \p)R > (208) 

l l 



X<P-i) k {d 2 + d) k . 

To save first inequality one needs p < |, Preserving the second one requires 



(209) 



1 -''._,(__] (210) 



This however is fulfilled for any p € (0, -|] if d is taken properly large for some fixed k. Indeed, the fc-th root of (which 
converges to 1 with k) can be greater than (which converges to 1 with d) for some large d. ■ 

C. Comparison of two criteria for secure key 

In this section, we shall compare the joint cryptographic criterion, i.e. the requirement of (11 12b : 

I I/O -PidtalW < £ ( 211 ) 

which includes both uniformity and security in one formula with the double condition where uniformity and security are treated 
separately, namely: 

x({Pi,Pij})<e (212) 

\\pAB -pfdealW < £ 

The connection between these two criteria for quantum cryptographical security of the state is given in the theorem below. 

Theorem 10: For any ccq state p ABE = Y,ij=aPij ® Pij and Pideal = Z)i=o Pe where p E = J2ijPijPij< 

the following implications holds: 



\\PAB - pf d B eal \\ <e 
x(Pabe) < e 



I /Oyis_E - Pideai || < e + Ve (213) 



PABE ~ p ld eal 1 1 < C <! n I „Jb „ ^ , " ' (214) 



x(pabe) < 4e log d + h(e) 
\pab- pf£ a i\ \ < e 

where = TtePabe, pf£ a i = T te Pi deal- 

Remark 4: We see that the result (12141 i is not fully satisfactory due to the term log d. However, one cannot get a better 
result. Indeed it is easy to construct a state, for which the Holevo function is of e log d order, though the state pab e is e close 
to some pideal state. As an example may serve an appropriate extension of the isotropic state, measured in computational basis: 

d-i j 

Pabe = (1 - e)(^ -|m)(«Ub) ® (|00)(00|) B + 

+ e ZJ ^Trfl^fe'l^ ® ( 215 ) 

where cr is maximally mixed state. If we consider now ptdeai = {Y^,iZo 5K*)(**Ub) ® (|00) (00|)b, it is easy to see that 
Hpabe — Pzdea;|| = 2e. However the value of the Holevo function equals /i(e) + elog(<i 2 — d). 

Remark 5: The main difficulty in the proof of the above theorem is to get the term log d (d x d is size of AB system) rather 
than logdABA'B' ■ The latter one would be obtained directly from Fannes type continuities. However to get logd we have to 
apply tricks based on twisting. It is quite convenient not to have Eve's dimension in equivalence formula. This is because Eve's 
dimension depends on the protocol that lead to the key (more specifically, it depends on the amount of communication). In 
contrast, dimension of Alice and Bob system is only the number of bits of obtained key. Thus, our equivalence is independent 
of the protocol. 

Proof: For the first part of the theorem [TOl we assume that x({PijiPfj}) £ which by proposition [7] in Sec. IXV-DI of 
Appendix means that we have: 

d-1 d-1 

II PijlifiitilAB ® Pij ~ PiAifiiwlAB ® Pe\\ < V^, (216) 

j,i=o i,j=0 
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with pe = J2i jLoPijPfj- Moreover by second assumption that 

d-l 



1 



i E PiM(ij\-Y,^ ii){iim - e (217) 

i,j—0 i 



one gets 

d-l d-l 



1 



II ^ Pij\ij)(ij\AB ® Pe -^2^\ii)(ii\AB ® Pe\\ < e- (218) 

i,j=0 i=0 

Using triangle inequality, and Eqs. ( 1216b and (I218l l one obtains the 

\\PABE ~ Pideal\\ < e + \fi. (219) 

The proof of the second part of the theorem [10] is a bit more involved. Of course, it is immediate that due to monotonicity 
of trace norm under partial trace, from Upabb — PideaiH < e it follows \ \pab — pfJ^aiW — e - ^ ne non-obvious task is to bound 
also x- So, we assume that 

| \PABE - Pideal 1 1 < £, (220) 

By equality of norm and fidelity condition ( TT3T >. there holds 

F(pABE, Pideal) > 1 ~ (221) 

By definition of fidelity, there are pure states tp and <fi (purifications of pabe and pideal respectively), such that F(ip,(f>) = 
F(pabe, Pideal)- Without loss of generality we can consider the system which purifies both states to be bipartite. We will 
call it A'B'. Now let us perform twisting operation on the ABA' B' parts of the pure states ip and <f>, which in the case of 
state pideal transforms AB subsystem of into maximally entangled state - Pt, (we can choose such twisting because by the 
theorem [2] purification of an ideal state is some pdit state). I.e. after such twisting, pdit will become a basic pdit © which 
is product with A'B' subsystem. Since unitary transformation and tracing out can only increase fidelity, then applying again 
(fT3l > we have that subsystem AB of pabe is close to a singlet state in norm: 

\\PAB-Pt\\ <2Vi- (222) 
Using Fannes inequality (see eq. [14] in Sec. Ill-Al l we get 

S{ P ab) < ^V~e log d + h{2yfe). (223) 
Since the total state of systems ABA'B'E is pure, we get that S(pa'B'e) = S(pab) hence 

S(pa'B'e) < 4V~e\ogd + h{2yfe). (224) 
Now, note that the state of the system A'B'E has the form 

d-l 

Pa>b>e - £ P l jPt- B ' E , (225) 

i,j=0 

where the state pfj B E denotes state of A'B'E system after twisting and given that AB subsystem is in state (i.e. if 

A[7- 

J l 3 



after twisting one measure the system AB in basis \ij) the system A' B'E would collapse to pf, B E ). By definition of Holevo 



function there holds: 

x{{Pv,P* B ' E })<S{p A >B'E). (226) 

The question is how the Holevo function of the {pij,pfj B E } ensemble is related to Holevo function of {pij,pfj} which 
we would like to bound from above. It is crucial, that by theorem [TJ twisting operation does not affect the ccq state which 
comes out of the measurement of AB in control basis of twisting. In other words, the ensemble {pi,pfj} does not change 
under twisting, so that p E = TrA'B'pfj B E ■ It is easy now to compare the functions x({Pij> pfj\) an( ^ xi{Piji pfj B E }) : 

x({p»,pF j })<x({pi j ,P^ B ' E }) (227) 

This is due to the fact, that each state p E can be obtained from pf^ B E by tracing out A'B' subsystem. However tracing out 
can only decrease Holevo function, because this function is equal to the average relative entropy: 

x({Pk,Pk}) = ^2pkS(p k \^2pkPk)- (228) 

k k 

Summing up the chain of inequalities (1224b . ( |226t and ( |227t one gets 

x{{Pij,pfj}) < 4Vilogd + / l (2 % /i). (229) 
which is a desired security condition - bound on the Holevo function of the ansamble {pij,p E }- ■ 
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D. Useful inequalities relating security conditions 

In this section we collect relations between different security conditions for ccq states. Some of these relations have been 
studied in [3]. Since we will not deal with uniformity, but solely with security, it is convenient to use single index k in place 
of ij. We thus consider ccq state (which could be actually called cq state) 

d 2 -i 

P=J2 Pk\k){k\®p k (230) 

fe=0 

Basing on this fact, we can state another lemma establishing some equivalences: 

Lemma 8: For any state ( 1230b and any positive real e < |, the following implications hold 

1) 

ii5>*i*>< fc i®p*-E pj \j) O'l) ® p\ i < « (23 1) 

fe j 
^PkF{p k ,p) > 1 - U 



2) 
3) 



X>fc^(Pfc,P) > l-e^J]p fe ||p fc -p|| <8e (232) 
fe k 

Y,Pk\\Pk-p\\<e=> (233) 

fe 

=> H2P*l*>< & l®W-(Z)PilJ>01)®p|l < e - 
fe j 

Here p = J2kP^Pk- 

Proof: The first thesis follows from the mentioned equivalence of norm and fidelity and definition of fidelity. Namely one 
can make use of lemma [T] so that if ( 123 U holds, the fidelity F( Ylk p k\k) (^1 ® Pfc> (IZj Pili)0'l) ® P) i s no l ess man 1 — 5 e - 
However it is equal to average fidelity J2kPkF(Pk, p)- Indeed, 



1 \ 2 



F(£pk\k){k\ ® p fc , £>b)<j|) ® P) = Ttf (I>k|*X*| ® 5>ilJ>01 ® p(E^>< Z I ® «)' ) (234) 

fe j fe j £ 

Now by orthogonality of vectors |fc) one has 



J2 Pk ^^ ® Pfe = H v^X^I ® VP^- (235) 
y fe fe 

Multiplying now the Q2jPj\j)(j\) ® P matrix by the above from left-hand-side and right-hand-side one gets 

Y,Pl\ k )( k \®VPkPVPk- (236) 

fe 

This immediately gives the above formula equal to 



X^P feTr V VPkPVPk (237) 
fe 

which is just average fidelity from ( 1232b . 

The second thesis of this lemma ( Eq. ( 12321 i) is again a consequence of ( fT3l . If applied to each pair pk, p, and averaged 
over probabilities of pk gives that 

J2 p kjl-\\\P-Pk\\ 2 >l-e (238) 
fe 

which is equivalent to 

5>fc (l - a/1- llp-Pfell 2 /4) < e. (239) 

fe 

Now by the fact that 

1 - \/l-|llp-Pfe|| 2 (240) 
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is a convex function of ||p — p k \\ on interval (0, 2) we get 



1 -y 1 ~iC[>ii' 9 -^ii] 2 ^ e (24 ^ 

This however reads for < e < 1 

Y,Pk\\P~ Pk\\<8e. (242) 

k 

Since ||p — p k \\ < 2 one has, that for e > 1 the above inequality is also valid, which completes the proof of the second thesis 
of lemma [8] 

The last implication (Eq. d2331 l) is a consequence of triangle inequality, which completes the lemma.H 
Let us notice, that this lemma establishes a kind of equivalance of security conditions, namely: 

||^p fe |/c)(/c|®p fe -(^ Pj |j)(j|)®p|| <e (243) 

k j 

^^Pk\\p- Pk\\ <4e 

k 

=> \\^Pk\k)(k\®p k -(22pj\j){j\)®p\\ ^ 4e 
k j 

We can show now links between the above conditions on ccq state and Holevo function x of this state, i.e. of an ansamble 
{Pk,Pk} which we shall write x(Pccg)- 

Lemma 9: For any ccq state p ccq d2301 l there holds: 

X{pcc q )<e^^p k \\pk- P\\ <V2~e (244) 
fc 

},Pk\\pk - P\\ < e x(Pccq) < 3elogd + max(/i(e), 2e) 

k 

where J2kP k P k = P> which acts on Hilbert space H = C d , and h(e) = — eloge — (1 — e) log(l — e) is binary entropy. 

Proof: For the first statement of this lemma, let us notice that x(Pccq) = S(p) — J2kPkS(pk) is just equal to average 
relative entropy distance J2kPkS(Pk\p)- Thus, by assumption we have 

x(Pccg) = ^2pkS{p k \p) < e. (245) 

k 

Now we can make use of the inequality [45]: 

\\\p-pk\\ 2 <S{ Pk \p) (246) 
which after averaging over probabilities and by concavity of square root gives 



$>fc||p-Pfc|| < 2j2pkS(p k \p). (247) 

k y k 

Applying now bound ( 1245b we obtain 

J2Pk\\p-Pk\\ < V2~e (248) 

which completes first thesis of this lemma. 

To prove the second statement of the lemma we use the Fannes inequality (see eq.[l4]in Sec. Ill- At . Namely, for < 1 

there holds: 

\S(p)-S( Pk )\<2\\p-p k \\\ogd + h(\\p-p k \\). (249) 

Let G = {k : \\p- p k \\ < 1} and B = {k : \\p - p k \\ > 1}, and denote Y,keaPk[ s (p) - S(Pk)} = XciPccq), and XB(p ccq ) 
analogously. We then have, that 

X(Pccq) = XG(Pccq) + XB(Pccq)- (250) 

We will give now the bounds for xaiPccq) and XB^Pccq) respectively. The first quantity is directly bounded by the analogous 
sum over LHS of the Fannes inequality: 

XG(Pccq) < 5^p fc (2||p-p fc ||logd + fc(||p-p fc ||)). (251) 

k£G 
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^From assumption 

$>fc||p-pk|| <e (252) 

k 

it follows that J2kecPk\\P — Pk\\ < £■ Using this, and adding non-negative terms ~}Z keB Pkh{\\p — Pk\\), we get: 

Xaipccq) < 2e\ogd + J2Pkh{\\p- Pk\\)- (253) 

k 

Now by concavity of binary entropy one gets 

XciPccq) < 2e\ogd + h{Y / Pk\\p- Pk\\), (254) 

k 

Were the entropy increasing on [0, oo] interval, one could use directly the assumption that J2kPk\\p ~ Pk\\ < e > ar, d bound 
h(J2kPk\\p ~ Pk\\) by h(e). Since it is the case only for e 6 [0, |], we have to end up with more ugly, but nonetheless useful 
expression. Namely on the interval (5,00] where the entropy becomes decreasing, it is bounded by 1, and hence not greater 
than 2e for e £ (|,oo]. Thus finally one gets 

XciPccq) < 2elogd + max(/ l (e),2e), (255) 

We turn now to give the bound for Xs(Pccg)- F° r the latter we use the fact, that the Holevo quantity is bounded from above 
by logd, which gives: 

Xb (Pccq) <^Pk log d. (256) 

keB 

To bound the last inequality we observe, that by definition of the set B we have J^keB Pk\\p ~ Pk\\ > J2keBPk- Then, again 
by assumption ( 1252b . we have 

XB(Pccq) < e log d. (257) 



Collecting inequality ( |255t and the above one, we arrive at the formula 

x(Pccq) < 3elogd + max(/i(e),2e), (258) 

which ends the proof of the lemma. ■ 

The lemmas above allow to prove the following proposition 
Proposition 7: For any ccq state ( 12301 ) the following holds: 

x({Pk,Pk}) < e => 

\\Y,Pk\ k ^ k \®Pk-CEPj\j)(3\)®p\\ < ^ (259) 

k j 

where p = J^kPkPk- 

Proof: Assuming that Holevo function is smaller than e, we get by lemma [9] that YlkPk\\pk ~ p\ \ < V^e. This however 
implies by lemma ([8]l that || ^Z k Pk\k){k\ ® pk — (52j Pj\j}{j\) <8> p\\ is also not greater than \/2e, which completes proof of 
the proposition. ■ 



E. Properties of pbits 

We shall give here detailed proof of the lemma [3] Section IIV-AI 

Proof: Log-negativity [56] (cf. [59]) is defined as E]y(p) — log(||p r ||). It is easy to see, that after partial transposition 
on BB' subsystem, the pbit 7 in X-form changes into 



r 

Iaba'B' 



Vxlo 

x r 

(Xt) r 

00 Vx^x 1 



We have 



where 



|| 7 r || = l(\\[VxJof\\ + Wl^xTxfw + \\A\\), 



A = 



(Xf 
(Xt) r 



(260) 

(261) 
(262) 
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By assumption, the operators [XX^] r and [X^X] r are positive, so that 

Wi^XJOfW + \\[VxVC] r \\ = Tr(VxXt + ^xTxf = 2Tr 7 r = 2. (263) 

The last equality comes from the fact that T preserves trace. To evaluate norm of A, we note that due to unitary invariance of 
trace norm we have \ \A\ \ — \ \<r x <g) I^'S'^H- Consequently 

||A|| = ||X r || + ||(Xt) r ||=2||X r ||. (264) 

The last equality follows form the fact that T commutes with Hermitian conjugation, and trace norm is invariant under Hermitian 
conjugation ||X|| = ||X^||. Thus we get 

E N (l) =log(l + ||X r ||), (265) 

which proves the lemma.a 



F. Relative entropy of entanglement and pdits 

We give now the proof of the theorem |4j Section [XV-FI 

Proof: If one consider the thesis of theorem [3] for the state p = i'aba'B'^ ^ f°ll° ws that 

E r (p) <\0gd n + —J2 E r (ff* ) . (266) 

fc=0 

with k being the multiindex k = (ij, ...,i n ) with ij £ {0, ...,d— 1} for I £ {1, ...,n} and <7fc = pi 1 ® ... Pi n . Dividing both 
sides by n we obtain 

The left-hand-side of this inequality approaches E^° (7) with n. What has to be shown is that 



" =0 nd n ^— ' ^— ' d 

fe=0 i=0 



(267) 



(268) 



with pi denoting the conditional states on A'B' subsystem. 

Let us first observe that E r {ak) = E r (ak>) for any k and k' which are of the same type, i.e. which has the same numbers 
of occurrence of symbols from set {0, ...,d— 1}. This is because Ok and a' k differ by local reversible transformation which 
does not change the entanglement. Moreover, as we will see, one can consider only those ak for which k is (5-strongly typical 
i.e. such, that for some fixed 6 > there holds [16]: 

V B6{ o,...,«i-i) I— -i|<*. (269) 
n a 

where a(k) denotes frequency of symbol a in sequence k. The set of such k of length n we will denote as ST$ l . It is known, 
that the strongly typical set carries almost whole probability mass for large n, that is for any S > and any e > there exists 
no such that for all n > uq: 

P® n {ST?) > 1 - e. (270) 

Now, since we deal here with homogeneous distribution, we can say, that the probability of the set of events is directly related 
to the power of this set. Namely we have: 

\ST?\/<P>l-e, (271) 

which gives \ST£\ > (1 - e)d n . 

We can rewrite now the term of the LHS of (1268b as follows: 



_L £ Er {a k ) = -U E E M + E E r(<Tk))- (272) 

k=0 fee ST™ kgST™ 

We can get rid of the second term of the RHS of the above equality, because we can bound from above for each k the term 
E r (ak) by nlogd, which gives: 

"^E^K)<-U E EM + nlogd E E ^(^)+elogd (273) 

fc=0 keST sn k<?ST» k£STV- 
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Now for each k S STJ 1 we have 



E r (a k ) = Eripf™ ® pf Al ® ... ® pH"" 1 ) (274) 
with m, = i(fc) with i in place of a in j269j . By subadditivity of £V one has 



d-l 



1=0 

Note, that pi stands here for the state on shield part of one copy of ^aba 1 b> ■ Applying this inequality for each k in STg and 
taking maximum of LHS of the above inequality over k, we have a bound: 

^ £VK) < £ \E r {pf^) + elo g d, (276) 
fc=o ;=o 

where mi are the coefficients of the decomposition of some a k into p® m <, which yields the maximal value of E r {a k ) over 
all strongly typical k. Now, we can rewrite the RHS of the above inequality as: 

J2 ^—E r (pf m ' ) + e\ogd<(^+S)J2—Er ( P f mi )+e\ogd (277) 
' n mi a z — ' m; 

where the last inequality holds for sufficiently high n by assumption of strong typicality. Thus, for every 5 and e and sufficiently 
large n there holds: 

4r E E r (a k )<^ + S)Y,—Er(pf m ') + ^ogd, (278) 

fe=0 i=0 

One then sees, that the RHS approaches 

d-l 

(j+$)J2 E ™M +el °z d (279) 

in limit of large n. Indeed, since for every I the limit E£°(pi) exists, the subsequence ■^-E r (pf' mi ) approaches this limit. 
Taking now infimum over 5 and e we prove the inequality ( 12681 ). This proves the theorem [4] ■ 

G. Approximate pbits 

We give here the proof of lemma [4] 

Proof: Assume first, that TtpabP+ > 1 — e. Since the elements aiju are real, by hermicity of the state we have 

TtpabP+ = ^(aoooo + aim + 2i?e(a 00 ii)) (280) 

This is however less than or equal to i(l + 2aoon), which is in turn greater than 1 — e, and the assertion follows. For the 
second part of the lemma, assume that a on > \ — £■ We then have 

TtpabP+ > ^(aoooo + aim + 1 - 2e). 

We now bound the sum of aoooo and aim. By positivity of the state, we have that ^/aoooo a im > l a oon|- Now, by 
arithmetic-geometric mean inequality, we have that aoooo + aim > 2-^/aooooami which gives the proof. ■ 

H. Relative entropy bound 

Proof: (of Lemma [7] Section IXII) Let us first show, that 

TrP+a AB < ~ (281) 
for any oab € T. We first show this for gab "derived" from some pure product states 

u AB = r TtA'B'U^){ijj\U. (282) 

Because -0 is product, it can be written as 

i> = (J2cii\iAM))®(£, b i\ i B)\<t>i)) (283) 
with <Zj, bi normalized and \i A ), |*b), (V'i)i |&) on subsystem A, B, A', B' respectively. 
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Now the condition that the reduced AB state has overlap with Pf no greater than 1 /d is 

^dibiap^Xilxj) < 1 (284) 

ij 

where x k are arbitrary vectors of norm one arising from the action of U on ipi and fa. Since the Xk are arbitrary they can 
incorporate the phases of <Zj,&j so that we require now J2ij y/PiQiPjQj ( x i\ x j) < !• where and <7i are probabilities. Now, 
the right hand side will not decrease if we assume (xi\xj) — 1 so we require Ei \JPi1i? < 1 which is satisfied by any 
probability distribution, which gives the proof of ( 128 11 1 for special gab- 
To show the inequality is true in general we find that 

TrP+Tr A , B ,U^p k \ip k )(Tp k \U = 
k 

PkTrP+Tr A , B , U^\^ k ) (Vfc | U. (285) 

k 

Thus if (I28U holds for cr^s derived from pure (product) state, by averaging over probabilities, we will have ( I28U for an 
arbitrary a A g from the set T. 

Now by concavity of logarithm, we have for any states p and a: 

S(p\\a) = -S(p)-Tr(ploga)> 

-S{p) - log(TrH (286) 

Applying inequality (I28U we have that 

-log(Trpa-) > logd. (287) 

Now by (I286b we have that 

5(P+||a AB )>logd, (288) 

which is a desired bound.a 
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